Cisco IOS up to 15.3 VFR 拒绝服务漏洞

CVE编号

CVE-2013-5474

利用情况

暂无

补丁情况

N/A

披露时间

2013-09-27

漏洞描述

Cisco IOS是多数思科系统路由器和网络交换机上使用的互联网络操作系统。 Cisco IOS IPv6的虚拟分片重组实现存在安全漏洞，未验证远程攻击者可利用漏洞使设备挂起或重载。漏洞是由于在访问IPv6分片重组队列时存在一个竞争条件错误，攻击者可发送特制的合法IPv6分片流触发该漏洞，处理这些分片时可导致受影响设备挂起或重载，持续发送该报文可造成拒绝服务攻击。 如下设备受此漏洞影响： Cisco IOS 12.3(11)T Base | 12.3(11)T10 Base | 12.3(11)T11 Base | 12.3(11)XL Base | 12.3(11)YK Base | 12.3(11)YN Base | 12.3(11)YS Base | 12.3(11)YZ Base | 12.3(11)YZ1 Base | 12.3(11)ZB Base | 12.3(14)T Base | 12.3(14)T7 Base | 12.3(14)YM8 Base | 12.3(14)YT Base | 12.3(4)XG Base | 12.3(4)XH Base | 12.3(4)XQ Base | 12.3(7)T Base | 12.3(7)T12 Base | 12.3(7)XL Base | 12.3(7)XR Base | 12.3(7)XS Base | 12.3(8)T Base | 12.3(8)XX Base | 12.3(8)YA Base | 12.3(8)YC Base | 12.3(8)YD Base | 12.3(8)YG Base | 12.3(8)YH Base | 12.3(8)YI Base | 12.3(8)ZA Base | 12.3T 12.3(11)T1, 12.3(11)T12, 12.3(11)T2, 12.3(11)T2a, 12.3(11)T3, 12.3(11)T4, 12.3(11)T5, 12.3(11)T6, 12.3(11)T7, 12.3(11)T8, 12.3(11)T9, 12.3(14)T1, 12.3(14)T2, 12.3(14)T3, 12.3(14)T4, 12.3(14)T5, 12.3(14)T6, 12.3(7)T1, 12.3(7)T10, 12.3(7)T11, 12.3(7)T2, 12.3(7)T3, 12.3(7)T4, 12.3(7)T6, 12.3(7)T7, 12.3(7)T8, 12.3(7)T9, 12.3(8)T1, 12.3(8)T10, 12.3(8)T11, 12.3(8)T2, 12.3(8)T3, 12.3(8)T4, 12.3(8)T5, 12.3(8)T6, 12.3(8)T7, 12.3(8)T8, 12.3(8)T9 | 12.3XG 12.3(4)XG1, 12.3(4)XG2, 12.3(4)XG3, 12.3(4)XG4, 12.3(4)XG5 | 12.3XH 12.3(4)XH1 | 12.3XK 12.3(4)XK, 12.3(4)XK1, 12.3(4)XK2, 12.3(4)XK3, 12.3(4)XK4 | 12.3XL 12.3(11)XL1, 12.3(11)XL2, 12.3(11)XL3 | 12.3XQ 12.3(4)XQ1 | 12.3XR 12.3(7)XR1, 12.3(7)XR2, 12.3(7)XR3, 12.3(7)XR4, 12.3(7)XR5, 12.3(7)XR6, 12.3(7)XR7 | 12.3XS 12.3(7)XS1, 12.3(7)XS2 | 12.3XX 12.3(8)XX1, 12.3(8)XX2e | 12.3YA 12.3(8)YA1 | 12.3YC 12.3(8)YC1, 12.3(8)YC2, 12.3(8)YC3 | 12.3YD 12.3(8)YD1 | 12.3YG 12.3(8)YG1, 12.3(8)YG2, 12.3(8)YG3, 12.3(8)YG4, 12.3(8)YG5, 12.3(8)YG6, 12.3(8)YG7 | 12.3YI 12.3(8)YI1, 12.3(8)YI2, 12.3(8)YI3 | 12.3YK 12.3(11)YK1, 12.3(11)YK2, 12.3(11)YK3 | 12.3YM 12.3(14)YM1, 12.3(14)YM10, 12.3(14)YM11, 12.3(14)YM12, 12.3(14)YM13, 12.3(14)YM2, 12.3(14)YM3, 12.3(14)YM4, 12.3(14)YM5, 12.3(14)YM6, 12.3(14)YM7, 12.3(14)YM9 | 12.3YS 12.3(11)YS1, 12.3(11)YS2 | 12.3YT 12.3(14)YT1 | 12.3YZ 12.3(11)YZ2 | 12.3ZA 12.3(8)ZA1 | 12.3ZB 12.3(11)ZB1, 12.3(11)ZB2 | 12.4 12.4(10c), 12.4(12c), 12.4(13d), 12.4(13e), 12.4(13f), 12.4(16), 12.4(16a), 12.4(16b), 12.4(17a), 12.4(17b), 12.4(18), 12.4(18a), 12.4(18b), 12.4(18c), 12.4(18d), 12.4(18e), 12.4(19), 12.4(21), 12.4(21a), 12.4(23), 12.4(23a), 12.4(23b), 12.4(23c), 12.4(23d), 12.4(23e), 12.4(25), 12.4(25a), 12.4(25b), 12.4(25c), 12.4(25d), 12.4(25e), 12.4(25f), 12.4(25g), 12.4(3h), 12.4(3i), 12.4(3j), 12.4(5c), 12.4(7f), 12.4(7g), 12.4(7h), 12.4(8d) | 12.4(1) Base | 12.4(10) Base | 12.4(10a) Base | 12.4(10b) Base | 12.4(11)T Base | 12.4(11)XJ Base | 12.4(11)XV Base | 12.4(11)XW Base | 12.4(12) Base | 12.4(12a) Base | 12.4(12b) Base | 12.4(13) Base | 12.4(13a) Base | 12.4(13b) Base | 12.4(13c) Base | 12.4(14)XK Base | 12.4(15)T Base | 12.4(15)XF Base | 12.4(17) Base | 12.4(1a) Base | 12.4(1b) Base | 12.4(1c) Base | 12.4(2)T Base | 12.4(2)T5 Base | 12.4(2)XA Base | 12.4(20)T Base | 12.4(24)T Base | 12.4(24)T3 Base | 12.4(3) Base | 12.4(3a) Base | 12.4(3b) Base | 12.4(3c) Base | 12.4(3d) Base | 12.4(3e) Base | 12.4(3f) Base | 12.4(3g) Base | 12.4(4)T Base | 12.4(4)T1 Base | 12.4(4)T2 Base | 12.4(4)T3 Base | 12.4(4)T4 Base | 12.4(4)XC Base | 12.4(4)XD Base | 12.4(5) Base | 12.4(5a) Base | 12.4(5b) Base | 12.4(6)T Base | 12.4(6)T1 Base | 12.4(6)T2 Base | 12.4(6)T3 Base | 12.4(6)XE Base | 12.4(6)XT Base | 12.4(7) Base | 12.4(7a) Base | 12.4(7b) Base | 12.4(7c) Base | 12.4(7d) Base | 12.4(7e) Base | 12.4(8) Base | 12.4(8a) Base | 12.4(8b) Base | 12.4(8c) Base | 12.4(9)T Base | 12.4GC 12.4(22)GC1, 12.4(22)GC1a, 12.4(24)GC1, 12.4(24)GC3, 12.4(24)GC3a, 12.4(24)GC4, 12.4(24)GC5 | 12.4M 12.4(21a)M1, 12.4(23b)M1, 12.4(5a)M0 | 12.4MDA 12.4(24)MDA, 12.4(24)MDA1, 12.4(24)MDA10, 12.4(24)MDA11, 12.4(24)MDA12, 12.4(24)MDA13, 12.4(24)MDA2, 12.4(24)MDA3, 12.4(24)MDA4, 12.4(24)MDA5, 12.4(24)MDA6, 12.4(24)MDA7, 12.4(24)MDA8, 12.4(24)MDA9 | 12.4MDB 12.4(24)MDB, 12.4(24)MDB1, 12.4(24)MDB10, 12.4(24)MDB11, 12.4(24)MDB12, 12.4(24)MDB13, 12.4(24)MDB14, 12.4(24)MDB3, 12.4(24)MDB4, 12.4(24)MDB5, 12.4(24)MDB5a, 12.4(24)MDB6, 12.4(24)MDB7, 12.4(24)MDB8, 12.4(24)MDB9 | 12.4MR 12.4(16)MR1, 12.4(16)MR2, 12.4(19)MR, 12.4(19)MR1, 12.4(19)MR2, 12.4(19)MR3, 12.4(20)MR, 12.4(20)MR2 | 12.4MRA 12.4(20)MRA, 12.4(20)MRA1 | 12.4MRB 12.4(20)MRB, 12.4(20)MRB1 | 12.4T 12.4(11)T1, 12.4(11)T2, 12.4(11)T3, 12.4(11)T4, 12.4(15)T1, 12.4(15)T10, 12.4(15)T11, 12.4(15)T12, 12.4(15)T13, 12.4(15)T13b, 12.4(15)T14, 12.4(15)T15, 12.4(15)T16, 12.4(15)T17, 12.4(15)T2, 12.4(15)T3, 12.4(15)T4, 12.4(15)T5, 12.4(15)T6, 12.4(15)T6a, 12.4(15)T7, 12.4(15)T8, 12.4(15)T9, 12.4(2)T1, 12.4(2)T2, 12.4(2)T3, 12.4(2)T4, 12.4(2)T6, 12.4(20)T1, 12.4(20)T2, 12.4(20)T3, 12.4(20)T4, 12.4(20)T5, 12.4(20)T5a, 12.4(20)T6, 12.4(22)T, 12.4(22)T1, 12.4(22)T2, 12.4(22)T3, 12.4(22)T4, 12.4(22)T5, 12.4(24)T1, 12.4(24)T2, 12.4(24)T31f, 12.4(24)T32f, 12.4(24)T33f, 12.4(24)T34f, 12.4(24)T35c, 12.4(24)T35f, 12.4(24)T3c, 12.4(24)T3e, 12.4(24)T3f, 12.4(24)T3g, 12.4(24)T4, 12.4(24)T4a, 12.4(24)T4b, 12.4(24)T4c, 12.4(24)T4d, 12.4(24)T4e, 12.4(24)T4f, 12.4(24)T4g, 12.4(24)T4h, 12.4(24)T4i, 12.4(24)T4j, 12.4(24)T4k, 12.4(24)T4l, 12.4(24)T4m, 12.4(24)T4n, 12.4(24)T5, 12.4(24)T6, 12.4(24)T7, 12.4(24)T8, 12.4(24)T9, 12.4(4)T5, 12.4(4)T6, 12.4(4)T7, 12.4(4)T8, 12.4(6)T10, 12.4(6)T11, 12.4(6)T12, 12.4(6)T4, 12.4(6)T5, 12.4(6)T5a, 12.4(6)T5b, 12.4(6)T5c, 12.4(6)T5e, 12.4(6)T5f, 12.4(6)T6, 12.4(6)T7, 12.4(6)T8, 12.4(6)T9, 12.4(9)T0a, 12.4(9)T1, 12.4(9)T2, 12.4(9)T3, 12.4(9)T4, 12.4(9)T5, 12.4(9)T6, 12.4(9)T7 | 12.4XA 12.4(2)XA1, 12.4(2)XA2 | 12.4XC 12.4(4)XC1, 12.4(4)XC2, 12.4(4)XC3, 12.4(4)XC4, 12.4(4)XC5, 12.4(4)XC6, 12.4(4)XC7 | 12.4XD 12.4(4)XD1, 12.4(4)XD10, 12.4(4)XD11, 12.4(4)XD12, 12.4(4)XD2, 12.4(4)XD3, 12.4(4)XD4, 12.4(4)XD5, 12.4(4)XD6, 12.4(4)XD7, 12.4(4)XD8, 12.4(4)XD9 | 12.4XE 12.4(6)XE1, 12.4(6)XE2, 12.4(6)XE3 | 12.4XJ 12.4(11)XJ1, 12.4(11)XJ2, 12.4(11)XJ3, 12.4(11)XJ4, 12.4(11)XJ5, 12.4(11)XJ6 | 12.4XQ 12.4(15)XQ, 12.4(15)XQ1, 12.4(15)XQ2, 12.4(15)XQ2a, 12.4(15)XQ2b, 12.4(15)XQ2c, 12.4(15)XQ2d, 12.4(15)XQ3, 12.4(15)XQ4, 12.4(15)XQ5, 12.4(15)XQ6, 12.4(15)XQ7, 12.4(15)XQ8 | 12.4XR 12.4(15)XR, 12.4(15)XR1, 12.4(15)XR10, 12.4(15)XR2, 12.4(15)XR3, 12.4(15)XR4, 12.4(15)XR5, 12.4(15)XR6, 12.4(15)XR7, 12.4(15)XR8, 12.4(15)XR9, 12.4(22)XR, 12.4(22)XR1, 12.4(22)XR10, 12.4(22)XR11, 12.4(22)XR12, 12.4(22)XR2, 12.4(22)XR3, 12.4(22)XR4, 12.4(22)XR5, 12.4(22)XR6, 12.4(22)XR7, 12.4(22)XR8, 12.4(22)XR9 | 12.4XT 12.4(6)XT1, 12.4(6)XT2 | 12.4XV 12.4(11)XV1 | 12.4XW 12.4(11)XW1, 12.4(11)XW10, 12.4(11)XW2, 12.4(11)XW3, 12.4(11)XW4, 12.4(11)XW5, 12.4(11)XW6, 12.4(11)XW7, 12.4(11)XW8, 12.4(11)XW9 | 12.4XY 12.4(15)XY, 12.4(15)XY1, 12.4(15)XY2, 12.4(15)XY3, 12.4(15)XY4, 12.4(15)XY5 | 12.4XZ 12.4(15)XZ, 12.4(15)XZ1, 12.4(15)XZ2 | 12.4YA 12.4(20)YA, 12.4(20)YA1, 12.4(20)YA2, 12.4(20)YA3 | 12.4YB 12.4(22)YB, 12.4(22)YB1, 12.4(22)YB4, 12.4(22)YB5, 12.4(22)YB6, 12.4(22)YB7, 12.4(22)YB8 | 12.4YD 12.4(22)YD, 12.4(22)YD1, 12.4(22)YD2, 12.4(22)YD3, 12.4(22)YD4 | 12.4YE 12.4(22)YE, 12.4(22)YE1, 12.4(22)YE2, 12.4(22)YE3, 12.4(22)YE4, 12.4(22)YE5, 12.4(22)YE6, 12.4(24)YE, 12.4(24)YE1, 12.4(24)YE2, 12.4(24)YE3, 12.4(24)YE3a, 12.4(24)YE3b, 12.4(24)YE3c, 12.4(24)YE3d, 12.4(24)YE3e, 12.4(24)YE4, 12.4(24)YE5, 12.4(24)YE6, 12.4(24)YE7 | 12.4YS 12.4(24)YS, 12.4(24)YS1 | 15.0(1)M1 Base | 15.0M 15.0(1)M, 15.0(1)M10, 15.0(1)M2, 15.0(1)M3, 15.0(1)M4, 15.0(1)M5, 15.0(1)M6, 15.0(1)M6a, 15.0(1)M7, 15.0(1)M8, 15.0(1)M9 | 15.0XA 15.0(1)XA, 15.0(1)XA1, 15.0(1)XA2, 15.0(1)XA3, 15.0(1)XA4, 15.0(1)XA5 | 15.1(2)T Base | 15.1GC 15.1(2)GC, 15.1(2)GC1, 15.1(2)GC2, 15.1(4)GC, 15.1(4)GC1 | 15.1M 15.1(4)M, 15.1(4)M0a, 15.1(4)M0b, 15.1(4)M1, 15.1(4)M2, 15.1(4)M3, 15.1(4)M3a, 15.1(4)M4, 15.1(4)M5, 15.1(4)M6 | 15.1T 15.1(1)T, 15.1(1)T1, 15.1(1)T2, 15.1(1)T3, 15.1(1)T4, 15.1(1)T5, 15.1(2)T0a, 15.1(2)T1, 15.1(2)T2, 15.1(2)T2a, 15.1(2)T3, 15.1(2)T4, 15.1(2)T5, 15.1(3)T, 15.1(3)T1, 15.1(3)T2, 15.1(3)T3, 15.1(3)T4 | 15.1XB 15.1(1)XB, 15.1(1)XB1, 15.1(1)XB2, 15.1(1)XB3, 15.1(4)XB4, 15.1(4)XB5, 15.1(4)XB5a, 15.1(4)XB6, 15.1(4)XB7, 15.1(4)XB8a | 15.2GC 15.2(1)GC, 15.2(1)GC1, 15.2(1)GC2, 15.2(2)GC, 15.2(3)GC | 15.2GCA 15.2(3)GCA | 15.2M 15.2(4)M, 15.2(4)M1, 15.2(4)M2, 15.2(4)M3 | 15.2T 15.2(1)T, 15.2(1)T1, 15.2(1)T2, 15.2(1)T3, 15.2(1)T3a, 15.2(1)T4, 15.2(2)T, 15.2(2)T1, 15.2(2)T2, 15.2(2)T3, 15.2(3)T, 15.2(3)T1, 15.2(3)T2 | 15.2XA 15.2(3)XA | 15.2XB 15.2(4)XB10 | 15.3T 15.3(1)T

解决建议

用户可参考如下厂商提供的安全公告获得补丁信息：http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130925-ipv6vfr

参考链接
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa...

受影响软件情况

#	类型	厂商	产品	版本	影响面
1
	运行在以下环境
	系统	cisco	ios	12.2	-
	运行在以下环境
	系统	cisco	ios	12.3	-
	运行在以下环境
	系统	cisco	ios	12.4	-
	运行在以下环境
	系统	cisco	ios	15.0	-
	运行在以下环境
	系统	cisco	ios	15.1	-
	运行在以下环境
	系统	cisco	ios	15.2	-
	运行在以下环境
	系统	cisco	ios	15.3	-

CVSS3评分 7.8

• 攻击路径 网络
• 攻击复杂度 低
• 权限要求 无
• 影响范围 N/A
• 用户交互 无
• 可用性 完全地
• 保密性 无
• 完整性 无

AV:N/AC:L/Au:N/C:N/I:N/A:C

CWE-ID	漏洞类型
CWE-362	使用共享资源的并发执行不恰当同步问题（竞争条件）

Exp相关链接

- avd.aliyun.com