Cisco IOS 11.1CC through 12.2 with Cisco Express Forwarding (CEF) enabled includes portions of previous packets in the padding of a MAC level packet when the MAC packet's length is less than the IP level packet length.

Excluding Cisco 12000 Series Internet Routers, all Cisco devices running Cisco IOS software that have Cisco Express Forwarding (CEF) enabled can leak information from previous packets that have been handled by the device. This can happen if the packet length described in the IP header is bigger than the physical packet size. Packets like these will be expanded to fit the IP length and, during that expansion, an information leak may occur. Please note that an attacker can only collect parts of some packets but not the whole session.
No other Cisco product is vulnerable. Devices that have fast switching enabled are not affected by this vulnerability. Cisco 12000 Series Internet Routers are not affected by this vulnerability.
The workaround for this vulnerability is to disable CEF.

If the remote device has Cisco Express Forwarding (CEF) enabled, it may leak information from previous packets that have been handled by the device. An attacker may use this vulnerability to sniff your network remotely. This vulnerability is documented as Cisco Bug ID CSCdu20643.

If the remote device has Cisco Express Forwarding (CEF) enabled, it may leak information from previous packets that have been handled by the device.

An attacker may use this flaw to sniff your network remotely.

This vulnerability is documented as Cisco Bug ID CSCdu20643.

ID	Name	Product	Family	Type	Severity
48964	Data Leak with Cisco Express Forwarding Enabled - Cisco Systems	Nessus	CISCO	Local	medium
2215	Cisco IOS CEF Packet Information Disclosure (Bug ID CSCdu20643)	Nessus Network Monitor	SNMP		medium
2214	Cisco IOS CEF Packet Information Disclosure (Bug ID CSCdu20643)	Nessus Network Monitor	SNMP		medium
2213	Cisco IOS CEF Packet Information Disclosure (Bug ID CSCdu20643)	Nessus Network Monitor	SNMP		medium
10983	Cisco IOS Cisco Express Forwarding (CEF) Previous Packet Information Disclosure (CSCdu20643)	Nessus	CISCO	Local	medium

Detections

Analytics

CVE-2002-0339

medium

Tenable Plugins

medium

medium

medium

medium

medium