Vulnslist

find the latest Cisco vulnerabilities

Cisco Packet Data Network Gateway IP Stack Denial of Service Vulnerability

Cisco-SA-20150714-CVE-2015-4273 · Medium · Published · Updated

A vulnerability in the IP stack of the Cisco Packet Data Network Gateway (PGW) could allow an unauthenticated, remote attacker to cause a partial denial of service (DoS) of the Session Manager service when a malformed IP packet is received. The vulnerability is due to improper input validation of certain fields in the IP packet. An attacker could exploit this vulnerability by crafting a malformed IP packet and sending it to the affected device. An exploit could allow the attacker to cause a DoS of the Session Manager service of the PGW. Cisco has confirmed the vulnerability and released software updates. To exploit this vulnerability, an attacker must be able to send malformed IP packets to the targeted device, making exploitation more difficult in environments that restrict network access from untrusted sources. Cisco indicates through the CVSS score that functional exploit code exists; however, the code is not known to be publicly available.

Cisco advisory ·CSAF JSON

Workarounds

Administrators are advised to apply the appropriate updates.

Administrators are advised to allow only trusted users to have network access.

Administrators are advised to monitor affected systems.

CVEsCVE-2015-4273
Cisco Bug IDsCSCut38476
CVSS ScoreBase 5.0
Base 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P/E:F/RL:OF/RC:C
Product Names From Source
Cisco ASR 5000 Series Software

CSAF Product Statuses

Product Status Source CVE Rows
Cisco ASR 5000 Series Software known_affected cisco_csaf CVE-2015-4273 1

Related Products

Product CVE Evidence
Cisco ASR 5000 Series Software CVE-2015-4273 Cisco OpenVuln · family-level