Detections
Analytics
Cisco IOS XR Software Intermediate System-to-Intermediate System DoS (cisco-sa-20200122-ios-xr-dos)
medium Nessus Plugin ID 134447
Language:
Synopsis
The remote device is missing a vendor-supplied security patchDescription
According to its self-reported version, the Cisco IOS XR Software is affected by a denial of service (DoS) vulnerability in the implementation of the Intermediate System-to-Intermediate System (IS-IS) routing protocol functionality due to improper handling of a Simple Network Management Protocol (SNMP) request for specific Object Identifiers (OIDs) by the IS-IS process. An Authenticated, remote attacker can exploit this, by sending a crafted SNMP request, in order to cause a DoS condition in the IS-IS process.Please see the included Cisco BIDs and Cisco Security Advisory for more information
Solution
Upgrade to the relevant fixed version referenced in Cisco bug IDs CSCvr62342.See Also
Plugin Details
Severity: Medium
ID: 134447
File Name: cisco-sa-20200122-ios-xr-dos.nasl
Version: 1.10
Type: combined
Family: CISCO
Published: 3/13/2020
Updated: 4/8/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.6
CVSS v2
Risk Factor: Medium
Base Score: 4
Temporal Score: 3
Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P
CVSS Score Source: CVE-2019-16027
CVSS v3
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 5.7
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/o:cisco:ios_xr
Required KB Items: Host/Cisco/IOS-XR/Version
Exploit Ease: No known exploits are available
Patch Publication Date: 1/22/2020
Vulnerability Publication Date: 1/22/2020
Reference Information
CVE: CVE-2019-16027