Cisco IOS XR Software Route Processor Denial of Service Vulnerability (cisco-sa-20131023-iosxr)

This script is Copyright (C) 2013 Tenable Network Security, Inc.


Synopsis :

The remote device is missing a vendor-supplied security patch.

Description :

Cisco IOS XR Software Releases 3.3.0 to 4.2.0 contain a vulnerability
when handling fragmented packets that could result in a denial of
service (DoS) condition of the Cisco CRS Route Processor cards listed in
the 'Affected Products' section of this advisory. The vulnerability is
due to improper handling of fragmented packets. The vulnerability could
cause the route processor, which processes the packets, to be unable to
transmit packets to the fabric. Customers that are running version
4.2.1 or later of Cisco IOS XR Software, or that have previously
installed the Software Maintenance Upgrades (SMU) for Cisco bug ID
CSCtz62593 are not affected by this vulnerability. Cisco has released
free software updates that address this vulnerability.

See also :

http://www.nessus.org/u?248a5be7

Solution :

Apply the relevant patch referenced in Cisco Security Advisory
cisco-sa-20131023-iosxr.

Risk factor :

High / CVSS Base Score : 7.1
(CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:C)
CVSS Temporal Score : 6.2
(CVSS2#E:ND/RL:OF/RC:C)
Public Exploit Available : true

Family: CISCO

Nessus Plugin ID: 71438 ()

Bugtraq ID: 63298

CVE ID: CVE-2013-5549