Sign-up

ID

VAR-200709-0190


CVE

CVE-2007-4789


TITLE

Cisco CSM Service disruption (DoS) Vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2007-002611

DESCRIPTION

Cisco Content Switching Modules (CSM) 4.2 before 4.2.7, and Cisco Content Switching Module with SSL (CSM-S) 2.1 before 2.1.6, when service termination is enabled, allow remote attackers to cause a denial of service (reboot) via unspecified vectors related to high network utilization, aka CSCsh57876. A remote attacker can exploit these issues to cause the affected devices to become unresponsive and possibly to reset. The Catalyst Content Switching Module (CSM) is an integrated server load-balancing line card for the Catalyst 6500 and 7600 series that improves the response time of client communications to endpoints. There is a denial of service vulnerability when the Catalyst content exchange module processes malformed traffic. Remote attackers may use this vulnerability to cause service unavailability. ---------------------------------------------------------------------- BETA test the new Secunia Personal Software Inspector! The Secunia PSI detects installed software on your computer and categorises it as either Insecure, End-of-Life, or Up-To-Date. Effectively enabling you to focus your attention on software installations where more secure versions are available from the vendors. 1) An unspecified error exists when processing certain TCP packets that were received out of order. This can be exploited to cause a high CPU load or a device reload due to a FPGA4 exception with icp.fatPath length error by sending specially crafted TCP packets to a vulnerable system. 2) An unspecified error exists within the "service termination" option, which can be exploited to cause a PGA4 exception 1 IDLE error under a high network load by sending specially crafted TCP packets to a vulnerable system. Vulnerability #1 is reported in CSM 4.2 prior to 4.2.3a and CMS-S 2.1prior to 2.1.2a. Vulnerability #2 is reported in CSM 4.2 prior to 4.2.7 and CMS-S 2.1 prior to 2.1.6. SOLUTION: Apply updated versions. See vendor advisory for details. PROVIDED AND/OR DISCOVERED BY: Reported by the vendor. ORIGINAL ADVISORY: http://www.cisco.com/en/US/products/products_security_advisory09186a00808b4d3b.shtml ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.07

sources: NVD: CVE-2007-4789 // JVNDB: JVNDB-2007-002611 // BID: 25547 // VULHUB: VHN-28151 // PACKETSTORM: 59133

AFFECTED PRODUCTS

vendor:ciscomodel:content switching modulesscope:eqversion:4.2

Trust: 1.6

vendor:ciscomodel:content switching module with sslscope:eqversion:2.1

Trust: 1.6

vendor:ciscomodel:content switching module with sslscope:ltversion:2.1

Trust: 0.8

vendor:ciscomodel:content switching modulesscope:eqversion:4.2.7

Trust: 0.8

vendor:ciscomodel:content switching module with sslscope:eqversion:2.1.6

Trust: 0.8

vendor:ciscomodel:content switching modulesscope:ltversion:4.2

Trust: 0.8

vendor:ciscomodel:csm-sscope:eqversion:2.1

Trust: 0.3

vendor:ciscomodel:csmscope:eqversion:4.2

Trust: 0.3

vendor:ciscomodel:csmscope: - version: -

Trust: 0.3

vendor:ciscomodel:csm-sscope:neversion:2.1.6

Trust: 0.3

vendor:ciscomodel:csm-s 2.1.2ascope:neversion: -

Trust: 0.3

vendor:ciscomodel:csmscope:neversion:4.2.7

Trust: 0.3

vendor:ciscomodel:csm 4.2.3ascope:neversion: -

Trust: 0.3

sources: BID: 25547 // JVNDB: JVNDB-2007-002611 // CNNVD: CNNVD-200709-088 // NVD: CVE-2007-4789

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2007-4789
value: HIGH

Trust: 1.0

NVD: CVE-2007-4789
value: HIGH

Trust: 0.8

CNNVD: CNNVD-200709-088
value: HIGH

Trust: 0.6

VULHUB: VHN-28151
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2007-4789
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-28151
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-28151 // JVNDB: JVNDB-2007-002611 // CNNVD: CNNVD-200709-088 // NVD: CVE-2007-4789

PROBLEMTYPE DATA

problemtype:CWE-16

Trust: 1.9

sources: VULHUB: VHN-28151 // JVNDB: JVNDB-2007-002611 // NVD: CVE-2007-4789

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200709-088

TYPE

configuration error

Trust: 0.6

sources: CNNVD: CNNVD-200709-088

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2007-002611

PATCH
title:cisco-sa-20070905-csmurl:http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20070905-csm
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2007-002611

EXTERNAL IDS
db:NVDid:CVE-2007-4789
Trust: 2.8
db:BIDid:25547
Trust: 2.0
db:SECUNIAid:26724
Trust: 1.8
db:VUPENid:ADV-2007-3062
Trust: 1.7
db:SECTRACKid:1018654
Trust: 1.7
db:OSVDBid:37501
Trust: 1.7
db:JVNDBid:JVNDB-2007-002611
Trust: 0.8
db:XFid:36453
Trust: 0.6
db:CISCOid:20070905 DENIAL OF SERVICE VULNERABILITIES IN CONTENT SWITCHING MODULE
Trust: 0.6
db:CNNVDid:CNNVD-200709-088
Trust: 0.6
db:VULHUBid:VHN-28151
Trust: 0.1
db:PACKETSTORMid:59133
Trust: 0.1
sources:
            
            
            VULHUB: VHN-28151 // 
            
            
            
            BID: 25547 // 
            
            
            
            JVNDB: JVNDB-2007-002611 // 
            
            
            
            PACKETSTORM: 59133 // 
            
            
            
            CNNVD: CNNVD-200709-088 // 
            
            
            
            NVD: CVE-2007-4789

REFERENCES
url:http://www.cisco.com/warp/public/707/cisco-sa-20070905-csm.shtml
Trust: 2.0
url:http://www.securityfocus.com/bid/25547
Trust: 1.7
url:http://osvdb.org/37501
Trust: 1.7
url:http://securitytracker.com/id?1018654
Trust: 1.7
url:http://secunia.com/advisories/26724
Trust: 1.7
url:http://www.vupen.com/english/advisories/2007/3062
Trust: 1.1
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/36453
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2007-4789
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2007-4789
Trust: 0.8
url:http://xforce.iss.net/xforce/xfdb/36453
Trust: 0.6
url:http://www.frsirt.com/english/advisories/2007/3062
Trust: 0.6
url:http://www.cisco.com/en/us/products/hw/modules/ps2706/ps780/index.html
Trust: 0.3
url:http://www.cisco.com/en/us/products/hw/modules/ps2706/products_qanda_item0900aecd801cad00.shtml
Trust: 0.3
url:/archive/1/478620
Trust: 0.3
url:http://secunia.com/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/product/15616/
Trust: 0.1
url:https://psi.secunia.com/
Trust: 0.1
url:http://secunia.com/advisories/26724/
Trust: 0.1
url:http://secunia.com/product/15617/
Trust: 0.1
url:http://www.cisco.com/en/us/products/products_security_advisory09186a00808b4d3b.shtml
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:http://secunia.com/about_secunia_advisories/
Trust: 0.1
sources:
            
            
            VULHUB: VHN-28151 // 
            
            
            
            BID: 25547 // 
            
            
            
            JVNDB: JVNDB-2007-002611 // 
            
            
            
            PACKETSTORM: 59133 // 
            
            
            
            CNNVD: CNNVD-200709-088 // 
            
            
            
            NVD: CVE-2007-4789

CREDITS
Cisco Security bulletin
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-200709-088

SOURCES
db:VULHUBid:VHN-28151
db:BIDid:25547
db:JVNDBid:JVNDB-2007-002611
db:PACKETSTORMid:59133
db:CNNVDid:CNNVD-200709-088
db:NVDid:CVE-2007-4789

LAST UPDATE DATE
2025-04-10T23:16:43.978000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-28151date:2017-07-29T00:00:00
db:BIDid:25547date:2016-07-05T22:00:00
db:JVNDBid:JVNDB-2007-002611date:2012-06-26T00:00:00
db:CNNVDid:CNNVD-200709-088date:2007-09-12T00:00:00
db:NVDid:CVE-2007-4789date:2025-04-09T00:30:58.490

SOURCES RELEASE DATE
db:VULHUBid:VHN-28151date:2007-09-10T00:00:00
db:BIDid:25547date:2007-09-05T00:00:00
db:JVNDBid:JVNDB-2007-002611date:2012-06-26T00:00:00
db:PACKETSTORMid:59133date:2007-09-07T06:01:27
db:CNNVDid:CNNVD-200709-088date:2007-09-10T00:00:00
db:NVDid:CVE-2007-4789date:2007-09-10T21:17:00