Details of VAR-201404-0018

ID

VAR-201404-0018

CVE

CVE-2012-4651

TITLE

Cisco IOS Denial of service in Japan (DoS) Vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2012-006196

DESCRIPTION

Cisco IOS before 15.3(2)T, when scansafe is enabled, allows remote attackers to cause a denial of service (latency) via SYN packets that are not accompanied by SYN-ACK packets from the Scan Safe Tower, aka Bug ID CSCub85451. Cisco IOS In ScanSafe Denial of service if enabled ( Latency ) There is a vulnerability that can be exploited. IOS is prone to a denial-of-service vulnerability. Cisco IOS is an operating system developed by Cisco in the United States for its network equipment. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [slackware-security] patch (SSA:2012-257-02) New patch packages are available for Slackware 12.1, 12.2, 13.0, 13.1, 13.37, and -current to fix a security issue. Here are the details from the Slackware 13.37 ChangeLog: +--------------------------+ patches/packages/patch-2.7-i486-1_slack13.37.txz: Upgraded. This version of patch ignores destination filenames that are absolute or that contain a component of "..", unless such a filename is provided as an argument. For more information, see: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4651 (* Security fix *) +--------------------------+ Where to find the new packages: +-----------------------------+ Thanks to the friendly folks at the OSU Open Source Lab (http://osuosl.org) for donating FTP and rsync hosting to the Slackware project! :-) Also see the "Get Slack" section on http://slackware.com for additional mirror sites near you. Updated package for Slackware 12.1: ftp://ftp.slackware.com/pub/slackware/slackware-12.1/patches/packages/patch-2.7-i486-1_slack12.1.tgz Updated package for Slackware 12.2: ftp://ftp.slackware.com/pub/slackware/slackware-12.2/patches/packages/patch-2.7-i486-1_slack12.1.tgz Updated package for Slackware 13.0: ftp://ftp.slackware.com/pub/slackware/slackware-13.0/patches/packages/patch-2.7-i486-1_slack13.0.txz Updated package for Slackware x86_64 13.0: ftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/packages/patch-2.7-x86_64-1_slack13.0.txz Updated package for Slackware 13.1: ftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/patch-2.7-i486-1_slack13.1.txz Updated package for Slackware x86_64 13.1: ftp://ftp.slackware.com/pub/slackware/slackware64-13.1/patches/packages/patch-2.7-x86_64-1_slack13.1.txz Updated package for Slackware 13.37: ftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages/patch-2.7-i486-1_slack13.37.txz Updated package for Slackware x86_64 13.37: ftp://ftp.slackware.com/pub/slackware/slackware64-13.37/patches/packages/patch-2.7-x86_64-1_slack13.37.txz Updated package for Slackware -current: ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/a/patch-2.7-i486-1.txz Updated package for Slackware x86_64 -current: ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/a/patch-2.7-x86_64-1.txz MD5 signatures: +-------------+ Slackware 12.1 package: ebe093df28fc95c594af368597bf7262 patch-2.7-i486-1_slack12.1.tgz Slackware 12.2 package: f39f3ce8bbba509b7e266b6c8c9dcf47 patch-2.7-i486-1_slack12.1.tgz Slackware 13.0 package: e8404d45a3b51f8a7ad67efedfb488d9 patch-2.7-i486-1_slack13.0.txz Slackware x86_64 13.0 package: 90d8b1e9237fe5080bd56a42de14d554 patch-2.7-x86_64-1_slack13.0.txz Slackware 13.1 package: f0fdc8a64eb8051527e9854ea9adba72 patch-2.7-i486-1_slack13.1.txz Slackware x86_64 13.1 package: 60c3b0f3d1bc49b7e0140cbe65114560 patch-2.7-x86_64-1_slack13.1.txz Slackware 13.37 package: e70793008f94ef1f7f39b5e444bce6eb patch-2.7-i486-1_slack13.37.txz Slackware x86_64 13.37 package: 6fc457dbe6d32fd747336eb271a49c08 patch-2.7-x86_64-1_slack13.37.txz Slackware -current package: 95134353a77428529c66f801f405bc05 a/patch-2.7-i486-1.txz Slackware x86_64 -current package: e0128639a440509600c060f2cd1e0530 a/patch-2.7-x86_64-1.txz Installation instructions: +------------------------+ Upgrade the package as root: # upgradepkg patch-2.7-i486-1_slack13.37.txz +-----+ Slackware Linux Security Team http://slackware.com/gpg-key security@slackware.com +------------------------------------------------------------------------+ | To leave the slackware-security mailing list: | +------------------------------------------------------------------------+ | Send an email to majordomo@slackware.com with this text in the body of | | the email message: | | | | unsubscribe slackware-security | | | | You will get a confirmation message back containing instructions to | | complete the process. Please do not reply to this email address. | +------------------------------------------------------------------------+ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iEYEARECAAYFAlBSlvYACgkQakRjwEAQIjNq4QCfToYaW19I79R748n7LK5gRxdN VdwAn1gKwMwexSfYJRQNcFTZdT7Ii4ip =HZF+ -----END PGP SIGNATURE-----

Trust: 2.07

sources: NVD: CVE-2012-4651 // JVNDB: JVNDB-2012-006196 // BID: 78128 // VULHUB: VHN-57932 // PACKETSTORM: 116587

AFFECTED PRODUCTS

vendor:	cisco	model:	ios	scope:	eq	version:	15.3	Trust: 1.9
vendor:	cisco	model:	ios	scope:	eq	version:	15.3\(3\)m1	Trust: 1.6
vendor:	cisco	model:	ios	scope:	eq	version:	15.3s	Trust: 1.6
vendor:	cisco	model:	ios	scope:	eq	version:	15.3\(2\)s	Trust: 1.6
vendor:	cisco	model:	ios	scope:	eq	version:	15.3\(3\)m	Trust: 1.6
vendor:	cisco	model:	ios	scope:	eq	version:	15.3\(3\)s	Trust: 1.6
vendor:	cisco	model:	ios	scope:	lte	version:	15.3\(3\)m2	Trust: 1.0
vendor:	cisco	model:	ios	scope:	lt	version:	15.3(2)t	Trust: 0.8
vendor:	cisco	model:	ios	scope:	eq	version:	15.3\(3\)m2	Trust: 0.6
vendor:	cisco	model:	ios 15.3 s	scope:	-	version:	-	Trust: 0.3

sources: BID: 78128 // JVNDB: JVNDB-2012-006196 // CNNVD: CNNVD-201404-452 // NVD: CVE-2012-4651

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2012-4651
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2012-4651
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201404-452
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-57932
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2012-4651
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-57932
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-57932 // JVNDB: JVNDB-2012-006196 // CNNVD: CNNVD-201404-452 // NVD: CVE-2012-4651

PROBLEMTYPE DATA

problemtype:

CWE-189

Trust: 1.9

sources: VULHUB: VHN-57932 // JVNDB: JVNDB-2012-006196 // NVD: CVE-2012-4651

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201404-452

TYPE

digital error

Trust: 0.6

sources: CNNVD: CNNVD-201404-452

CONFIGURATIONS

sources: JVNDB: JVNDB-2012-006196

EXPLOIT AVAILABILITY

sources: VULHUB: VHN-57932

PATCH

title:

Release Notes for Cisco IOS Release 15.3M&T

url:

http://www.cisco.com/c/en/us/td/docs/ios/15_3m_and_t/release/notes/15_3m_and_t.pdf

Trust: 0.8

sources: JVNDB: JVNDB-2012-006196

EXTERNAL IDS

db:	NVD	id:	CVE-2012-4651	Trust: 2.9
db:	JVNDB	id:	JVNDB-2012-006196	Trust: 0.8
db:	CNNVD	id:	CNNVD-201404-452	Trust: 0.7
db:	BID	id:	78128	Trust: 0.4
db:	PACKETSTORM	id:	116587	Trust: 0.2
db:	VULHUB	id:	VHN-57932	Trust: 0.1

sources: VULHUB: VHN-57932 // BID: 78128 // JVNDB: JVNDB-2012-006196 // PACKETSTORM: 116587 // CNNVD: CNNVD-201404-452 // NVD: CVE-2012-4651

REFERENCES

url:	http://www.cisco.com/c/en/us/td/docs/ios/15_3m_and_t/release/notes/15_3m_and_t.pdf	Trust: 2.0
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-4651	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-4651	Trust: 0.8
url:	http://slackware.com	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2012-4651	Trust: 0.1
url:	http://osuosl.org)	Trust: 0.1
url:	http://slackware.com/gpg-key	Trust: 0.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-4651	Trust: 0.1

sources: VULHUB: VHN-57932 // BID: 78128 // JVNDB: JVNDB-2012-006196 // PACKETSTORM: 116587 // CNNVD: CNNVD-201404-452 // NVD: CVE-2012-4651

CREDITS

Unknown

Trust: 0.3

sources: BID: 78128

SOURCES

db:	VULHUB	id:	VHN-57932
db:	BID	id:	78128
db:	JVNDB	id:	JVNDB-2012-006196
db:	PACKETSTORM	id:	116587
db:	CNNVD	id:	CNNVD-201404-452
db:	NVD	id:	CVE-2012-4651

LAST UPDATE DATE

2025-04-13T23:10:18.162000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-57932	date:	2014-04-23T00:00:00
db:	BID	id:	78128	date:	2014-04-23T00:00:00
db:	JVNDB	id:	JVNDB-2012-006196	date:	2014-04-24T00:00:00
db:	CNNVD	id:	CNNVD-201404-452	date:	2014-04-25T00:00:00
db:	NVD	id:	CVE-2012-4651	date:	2025-04-12T10:46:40.837

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-57932	date:	2014-04-23T00:00:00
db:	BID	id:	78128	date:	2014-04-23T00:00:00
db:	JVNDB	id:	JVNDB-2012-006196	date:	2014-04-24T00:00:00
db:	PACKETSTORM	id:	116587	date:	2012-09-15T18:55:55
db:	CNNVD	id:	CNNVD-201404-452	date:	2014-04-25T00:00:00
db:	NVD	id:	CVE-2012-4651	date:	2014-04-23T11:52:59.133