Details of VAR-201404-0031

ID

VAR-201404-0031

CVE

CVE-2012-5032

TITLE

Cisco IOS of ipsec-ikev2 Implementation FlexVPN In the load balancing function VPN Vulnerabilities that trigger traffic forwarding

Trust: 0.8

sources: JVNDB: JVNDB-2012-006200

DESCRIPTION

The Flex-VPN load-balancing feature in the ipsec-ikev2 implementation in Cisco IOS before 15.1(1)SY3 does not require authentication, which allows remote attackers to trigger the forwarding of VPN traffic to an attacker-controlled destination, or the discarding of this traffic, by arranging for an arbitrary device to become a cluster member, aka Bug ID CSCub93641. Cisco IOS is the interconnected network operating system used on most Cisco system routers and network switches. IOS is prone to a remote security vulnerability. The vulnerability is caused by the fact that the program does not perform authentication operations

Trust: 2.52

sources: NVD: CVE-2012-5032 // JVNDB: JVNDB-2012-006200 // CNVD: CNVD-2014-02641 // BID: 78083 // VULHUB: VHN-58313

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2014-02641

AFFECTED PRODUCTS

vendor:	cisco	model:	ios	scope:	eq	version:	15.1	Trust: 2.5
vendor:	cisco	model:	ios	scope:	eq	version:	15.1\(1\)sy	Trust: 1.6
vendor:	cisco	model:	ios	scope:	eq	version:	15.1\(1\)sy1	Trust: 1.6
vendor:	cisco	model:	ios	scope:	lte	version:	15.1\(1\)sy2	Trust: 1.0
vendor:	cisco	model:	ios	scope:	lt	version:	15.1(1)sy3	Trust: 0.8
vendor:	cisco	model:	ios	scope:	eq	version:	15.1\(1\)sy2	Trust: 0.6
vendor:	cisco	model:	iosmigrate 15.1 sy2	scope:	-	version:	-	Trust: 0.3
vendor:	cisco	model:	iosmigrate 15.1 sy	scope:	-	version:	-	Trust: 0.3
vendor:	cisco	model:	ios 15.1 sy1	scope:	-	version:	-	Trust: 0.3

sources: CNVD: CNVD-2014-02641 // BID: 78083 // JVNDB: JVNDB-2012-006200 // CNNVD: CNNVD-201404-456 // NVD: CVE-2012-5032

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2012-5032
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2012-5032
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2014-02641
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201404-456
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-58313
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2012-5032
severity:	MEDIUM
baseScore:	6.4
vectorString:	AV:N/AC:L/AU:N/C:N/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2014-02641
severity:	MEDIUM
baseScore:	6.4
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-58313
severity:	MEDIUM
baseScore:	6.4
vectorString:	AV:N/AC:L/AU:N/C:N/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: CNVD: CNVD-2014-02641 // VULHUB: VHN-58313 // JVNDB: JVNDB-2012-006200 // CNNVD: CNNVD-201404-456 // NVD: CVE-2012-5032

PROBLEMTYPE DATA

problemtype:

CWE-287

Trust: 1.9

sources: VULHUB: VHN-58313 // JVNDB: JVNDB-2012-006200 // NVD: CVE-2012-5032

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201404-456

TYPE

authorization issue

Trust: 0.6

sources: CNNVD: CNNVD-201404-456

CONFIGURATIONS

sources: JVNDB: JVNDB-2012-006200

PATCH

title:	Release Notes for Cisco IOS Release 15.1SY	url:	http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/15-1SY/release_notes.pdf	Trust: 0.8
title:	Cisco IOS has patches that are not explicitly vulnerable	url:	https://www.cnvd.org.cn/patchInfo/show/45180	Trust: 0.6

sources: CNVD: CNVD-2014-02641 // JVNDB: JVNDB-2012-006200

EXTERNAL IDS

db:	NVD	id:	CVE-2012-5032	Trust: 3.4
db:	JVNDB	id:	JVNDB-2012-006200	Trust: 0.8
db:	CNNVD	id:	CNNVD-201404-456	Trust: 0.7
db:	CNVD	id:	CNVD-2014-02641	Trust: 0.6
db:	BID	id:	78083	Trust: 0.4
db:	VULHUB	id:	VHN-58313	Trust: 0.1

sources: CNVD: CNVD-2014-02641 // VULHUB: VHN-58313 // BID: 78083 // JVNDB: JVNDB-2012-006200 // CNNVD: CNNVD-201404-456 // NVD: CVE-2012-5032

REFERENCES

url:	http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/15-1sy/release_notes.pdf	Trust: 2.6
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-5032	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-5032	Trust: 0.8

sources: CNVD: CNVD-2014-02641 // VULHUB: VHN-58313 // BID: 78083 // JVNDB: JVNDB-2012-006200 // CNNVD: CNNVD-201404-456 // NVD: CVE-2012-5032

CREDITS

Unknown

Trust: 0.3

sources: BID: 78083

SOURCES

db:	CNVD	id:	CNVD-2014-02641
db:	VULHUB	id:	VHN-58313
db:	BID	id:	78083
db:	JVNDB	id:	JVNDB-2012-006200
db:	CNNVD	id:	CNNVD-201404-456
db:	NVD	id:	CVE-2012-5032

LAST UPDATE DATE

2025-04-14T23:28:15.541000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2014-02641	date:	2014-04-25T00:00:00
db:	VULHUB	id:	VHN-58313	date:	2014-04-23T00:00:00
db:	BID	id:	78083	date:	2014-04-23T00:00:00
db:	JVNDB	id:	JVNDB-2012-006200	date:	2014-04-24T00:00:00
db:	CNNVD	id:	CNNVD-201404-456	date:	2014-04-25T00:00:00
db:	NVD	id:	CVE-2012-5032	date:	2025-04-12T10:46:40.837

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2014-02641	date:	2014-04-25T00:00:00
db:	VULHUB	id:	VHN-58313	date:	2014-04-23T00:00:00
db:	BID	id:	78083	date:	2014-04-23T00:00:00
db:	JVNDB	id:	JVNDB-2012-006200	date:	2014-04-24T00:00:00
db:	CNNVD	id:	CNNVD-201404-456	date:	2014-04-25T00:00:00
db:	NVD	id:	CVE-2012-5032	date:	2014-04-23T11:52:59.167