bugtraq - Cisco Security Advisory: Cisco IOS and NX-OS Software Locator/ID Separation Protocol Packet Denial of Service Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-id: <201603231436.5.lisp@psirt.cisco.com>
Date: Wed, 23 Mar 2016 14:36:07 -0400
From: Cisco Systems Product Security Incident Response Team <psirt@...co.com>
To: bugtraq@...urityfocus.com
Cc: psirt@...co.com
Subject: Cisco Security Advisory: Cisco IOS and NX-OS Software Locator/ID Separation Protocol Packet Denial of Service Vulnerability 

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Cisco Security Advisory: Cisco IOS and NX-OS Software Locator/ID Separation Protocol Packet Denial of Service Vulnerability

Advisory ID: cisco-sa-20160323-lisp

Revision 1.0

For Public Release 2016 March 23 16:00  GMT

+---------------------------------------------------------------------

Summary
=======

A vulnerability in the Locator/ID Separation Protocol (LISP) of Cisco IOS Software running on the Cisco Catalyst 6500 and 6800 Series Switches and Cisco NX-OS Software running on the Cisco Nexus 7000 and Nexus 7700 Series Switches with an M1 Series Gigabit Ethernet Module could allow an unauthenticated, remote attacker to cause a reload of the vulnerable device.

The vulnerability is due to a lack of proper input validation when a malformed LISP packet header is received. An attacker could exploit this vulnerability by sending a malformed LISP packet on UDP port 4341. An exploit could allow the attacker to cause a denial of service (DoS) condition.

Cisco has released software updates that address this vulnerability. 

This advisory is available at the following link:

 http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160323-lisp

This advisory is part of the March 23, 2016, release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication, which includes six Cisco Security Advisories that describe six vulnerabilities. All the vulnerabilities have a Security Impact Rating of "High." For a complete list of advisories and links to them, see Cisco Event Response:
http://www.cisco.com/c/en/us/about/security-center/event-response/cisco-erp-march-2016.html

-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - http://gpgtools.org

iQIcBAEBCAAGBQJW8DU6AAoJEK89gD3EAJB5IbQQALgBYRKsbfb0HRq6PwrX6hXZ
YSGvdheiu6Rk4qRM2xGrM0wX2pzux7iEiP2j9Ts9bhCs6Fhkh7RDWdSN06p8PzOy
pxaKtqIDnG838mhhDtoGkKB2LW+KpMK/5LxC5vWXXhYJ9BqaGZUXWUQQOgPfmfVP
mkYUwc3VrvEOfvrEE5DGgjrNcXWb6WzJPEyDW6icTOftl5m1Rx80Jstf9aPx72Dl
MYA7VuzzeBb4jl4E9/QyOEXw9m4l0cuk98LLlbDSu/Cn01hEUjLruWUubANxmxDk
IZv8hk7aJcLUQd5J3Go0YYZWWUq9rvivguO7wzlp7bXBr6q/XNieFqZl0T6AMuBz
tdA+FYfPbkbqNnbxodcSzphICVMFHX0SINBHVlstMfWzjwnHrgipa1NPDEBLDoxk
lglefU5zDxlM34Bh5+HSXQlRqLqfOhoKpStUX00DK68LtovElLQtfFRswmFtIaMK
aunBRXLFfA1rig6s2kPC6eyovYGPaph/744EfXcrSL1h5VKEBhFCRa8bDY7TpeyV
ZgFDWYA6vE0goEbHGH9f3L19NNrWD19t4IqhPdPkukgMZJixjU73tJwBYxKDwuAZ
lsvyK7iJrfu4zbzJ7+Cr16erk8zxBPWgT7KqDwU+rxYRet/Q7RxhNtwOYbWZfoBm
OhYo0ifUMRG2+AMJMsZI
=v8Kq
-----END PGP SIGNATURE-----