Loading...
Loading...
A vulnerability within the SNMP subsystem of Cisco IOS XE software could allow an authenticated, remote attacker to create a denial of service (DoS) condition. The vulnerability is due to an attempt to double free a region of memory when processing a series of SNMP read requests that contains certain criteria for a specific OID. An attacker with the ability to authenticate to an affected device may submit a series of valid, but specially formed SNMP requests designed to trigger the vulnerability. Successful exploitation will result in the device restarting due to an attempt to access an invalid memory region.
Devices running software versions 3.15S, 3.16S, and 3.17S before the first fixed version of Cisco IOS-XE and configured to allow SNMP requests. The are vulnerable.
N/A
PSIRT Evaluation: The Cisco PSIRT has assigned this bug the following CVSS version 2 score. The Base and Temporal CVSS scores as of the time of evaluation are 6.8/5.6: http://tools.cisco.com/security/center/cvssCalculator.x?vector=AV:N/AC:L/Au:S/C:N/I:N/A:C/E:F/RL:OF/RC:C&version=2.0 CVE ID CVE-2016-1428 has been assigned to document this issue. Additional information on Cisco's security vulnerability policy can be found at the following URL: http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
Click on a version to see all relevant bugs
Cisco Integration
Learn more about where this data comes from
Bug Scrub Advisor
Streamline upgrades with automated vendor bug scrubs
BugZero Enterprise
Wish you caught this bug sooner? Get proactive today.