Sign-up

ID

VAR-201609-0309


CVE

CVE-2016-6398


TITLE

Cisco IOS of PPTP Vulnerability in server that can obtain important information from past network communication

Trust: 0.8

sources: JVNDB: JVNDB-2016-004638

DESCRIPTION

The PPTP server in Cisco IOS 15.5(3)M does not properly initialize packet buffers, which allows remote attackers to obtain sensitive information from earlier network communication by reading packet data, aka Bug ID CSCvb16274. Cisco IOS is an operating system developed by Cisco Systems for its network devices. This issue is being tracked by Cisco bug ID CSCvb16274

Trust: 2.52

sources: NVD: CVE-2016-6398 // JVNDB: JVNDB-2016-004638 // CNVD: CNVD-2016-07254 // BID: 92734 // VULHUB: VHN-95218

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2016-07254

AFFECTED PRODUCTS

vendor:ciscomodel:iosscope:eqversion:15.5\(3\)m

Trust: 1.6

vendor:ciscomodel:iosscope:eqversion:15.5(3)m

Trust: 0.8

vendor:ciscomodel:iosscope: - version: -

Trust: 0.6

vendor:ciscomodel:iosscope:eqversion:0

Trust: 0.3

sources: CNVD: CNVD-2016-07254 // BID: 92734 // JVNDB: JVNDB-2016-004638 // CNNVD: CNNVD-201609-048 // NVD: CVE-2016-6398

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2016-6398
value: MEDIUM

Trust: 1.0

NVD: CVE-2016-6398
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2016-07254
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201609-048
value: MEDIUM

Trust: 0.6

VULHUB: VHN-95218
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2016-6398
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2016-07254
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-95218
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2016-6398
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 1.4
version: 3.0

Trust: 1.8

sources: CNVD: CNVD-2016-07254 // VULHUB: VHN-95218 // JVNDB: JVNDB-2016-004638 // CNNVD: CNNVD-201609-048 // NVD: CVE-2016-6398

PROBLEMTYPE DATA

problemtype:CWE-200

Trust: 1.9

sources: VULHUB: VHN-95218 // JVNDB: JVNDB-2016-004638 // NVD: CVE-2016-6398

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201609-048

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-201609-048

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2016-004638

PATCH
title:cisco-sa-20160902-iosurl:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160902-ios
Trust: 0.8
title:Patch for CiscoIOS Information Disclosure Vulnerability (CNVD-2016-07254)url:https://www.cnvd.org.cn/patchInfo/show/81157
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2016-07254 // 
            
            
            
            JVNDB: JVNDB-2016-004638

EXTERNAL IDS
db:NVDid:CVE-2016-6398
Trust: 3.4
db:BIDid:92734
Trust: 2.6
db:SECTRACKid:1036732
Trust: 1.1
db:JVNDBid:JVNDB-2016-004638
Trust: 0.8
db:CNNVDid:CNNVD-201609-048
Trust: 0.7
db:CNVDid:CNVD-2016-07254
Trust: 0.6
db:NSFOCUSid:34778
Trust: 0.6
db:VULHUBid:VHN-95218
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2016-07254 // 
            
            
            
            VULHUB: VHN-95218 // 
            
            
            
            BID: 92734 // 
            
            
            
            JVNDB: JVNDB-2016-004638 // 
            
            
            
            CNNVD: CNNVD-201609-048 // 
            
            
            
            NVD: CVE-2016-6398

REFERENCES
url:http://www.securityfocus.com/bid/92734
Trust: 2.3
url:http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20160902-ios
Trust: 2.0
url:http://www.securitytracker.com/id/1036732
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-6398
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-6398
Trust: 0.8
url:http://www.nsfocus.net/vulndb/34778
Trust: 0.6
url:http://www.cisco.com/
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2016-07254 // 
            
            
            
            VULHUB: VHN-95218 // 
            
            
            
            BID: 92734 // 
            
            
            
            JVNDB: JVNDB-2016-004638 // 
            
            
            
            CNNVD: CNNVD-201609-048 // 
            
            
            
            NVD: CVE-2016-6398

CREDITS
Cisco
Trust: 0.9
sources:
            
            
            BID: 92734 // 
            
            
            
            CNNVD: CNNVD-201609-048

SOURCES
db:CNVDid:CNVD-2016-07254
db:VULHUBid:VHN-95218
db:BIDid:92734
db:JVNDBid:JVNDB-2016-004638
db:CNNVDid:CNNVD-201609-048
db:NVDid:CVE-2016-6398

LAST UPDATE DATE
2025-04-13T23:35:03.582000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2016-07254date:2016-09-06T00:00:00
db:VULHUBid:VHN-95218date:2016-11-28T00:00:00
db:BIDid:92734date:2016-09-02T00:00:00
db:JVNDBid:JVNDB-2016-004638date:2016-09-14T00:00:00
db:CNNVDid:CNNVD-201609-048date:2016-09-13T00:00:00
db:NVDid:CVE-2016-6398date:2025-04-12T10:46:40.837

SOURCES RELEASE DATE
db:CNVDid:CNVD-2016-07254date:2016-09-06T00:00:00
db:VULHUBid:VHN-95218date:2016-09-12T00:00:00
db:BIDid:92734date:2016-09-02T00:00:00
db:JVNDBid:JVNDB-2016-004638date:2016-09-14T00:00:00
db:CNNVDid:CNNVD-201609-048date:2016-09-06T00:00:00
db:NVDid:CVE-2016-6398date:2016-09-12T10:59:10.507