Detections
Analytics
Cisco IOS Virtual Private Dial-up Network Denial of Service Vulnerability - Cisco Systems
high Nessus Plugin ID 49013
Language:
Synopsis
The remote device is missing a vendor-supplied security patch.Description
Two vulnerabilities exist in the virtual private dial-up network (VPDN) solution when Point-to-Point Tunneling Protocol (PPTP) is used in certain Cisco IOS releases prior to 12.3. PPTP is only one of the supported tunneling protocols used to tunnel PPP frames within the VPDN solution.The first vulnerability is a memory leak that occurs as a result of PPTP session termination. The second vulnerability may consume all interface descriptor blocks on the affected device because those devices will not reuse virtual access interfaces. If these vulnerabilities are repeatedly exploited, the memory and/or interface resources of the attacked device may be depleted.
Cisco has made free software available to address these vulnerabilities for affected customers.
There are no workarounds available to mitigate the effects of these vulnerabilities.
Solution
Apply the relevant patch referenced in Cisco Security Advisory cisco-sa-20080326-pptp.See Also
Plugin Details
Severity: High
ID: 49013
File Name: cisco-sa-20080326-pptphttp.nasl
Version: 1.20
Type: local
Family: CISCO
Published: 9/1/2010
Updated: 11/15/2018
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.6
CVSS v2
Risk Factor: High
Base Score: 7.1
Temporal Score: 5.3
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:C
Vulnerability Information
CPE: cpe:/o:cisco:ios
Required KB Items: Host/Cisco/IOS/Version
Exploit Ease: No known exploits are available
Patch Publication Date: 3/26/2008
Vulnerability Publication Date: 3/26/2008
Reference Information
CVE: CVE-2008-1150, CVE-2008-1151
BID: 28460