This script is (C) 2010-2014 Tenable Network Security, Inc.
The remote device is missing a vendor-supplied security patch
Excluding Cisco 12000 Series Internet Routers, all Cisco devices
running Cisco IOS software that have Cisco Express Forwarding (CEF)
enabled can leak information from previous packets that have been
handled by the device. This can happen if the packet length described
in the IP header is bigger than the physical packet size. Packets like
these will be expanded to fit the IP length and, during that expansion,
an information leak may occur. Please note that an attacker can only
collect parts of some packets but not the whole session.
No other Cisco product is vulnerable. Devices that have fast switching
enabled are not affected by this vulnerability. Cisco 12000 Series
Internet Routers are not affected by this vulnerability.
The workaround for this vulnerability is to disable CEF.
See also :
Apply the relevant patch referenced in Cisco Security Advisory
Risk factor :
Medium / CVSS Base Score : 5.0
CVSS Temporal Score : 3.7
Public Exploit Available : false
Nessus Plugin ID: 48964 (cisco-sa-20020227-ios-cefhttp.nasl)
Bugtraq ID: 4191
CVE ID: CVE-2002-0339
The cookie settings on this website are set to 'allow all cookies' to give you the very best website experience. If you continue without changing these settings, you consent to this - but if you want, you can opt out of all cookies by clicking below.