Cisco IOS Software Layer 2 Tunneling Protocol (L2TP) Denial of Service Vulnerability

high Nessus Plugin ID 49021

Language:

Synopsis

The remote device is missing a vendor-supplied security patch.

Description

A vulnerability exists in the Cisco IOS software implementation of Layer 2 Tunneling Protocol (L2TP), which affects limited Cisco IOS software releases.
Several features enable the L2TP mgmt daemon process within Cisco IOS software, including but not limited to Layer 2 virtual private networks (L2VPN), Layer 2 Tunnel Protocol Version 3 (L2TPv3), Stack Group Bidding Protocol (SGBP) and Cisco Virtual Private Dial-Up Networks (VPDN). Once this process is enabled the device is vulnerable.
This vulnerability will result in a reload of the device when processing a specially crafted L2TP packet.
Cisco has released free software updates that address this vulnerability.
Workarounds that mitigate this vulnerability are available.

Solution

Apply the relevant patch referenced in Cisco Security Advisory cisco-sa-20080924-l2tp.

Plugin Details

Severity: High

ID: 49021

File Name: cisco-sa-20080924-l2tphttp.nasl

Version: 1.20

Type: local

Family: CISCO

Published: 9/1/2010

Updated: 11/15/2018

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

Vulnerability Information

CPE: cpe:/o:cisco:ios

Required KB Items: Host/Cisco/IOS/Version

Exploit Ease: No known exploits are available

Patch Publication Date: 9/24/2008

Vulnerability Publication Date: 9/24/2008

Reference Information

CVE: CVE-2008-3813

BID: 31358

CISCO-SA: cisco-sa-20080924-l2tp

CISCO-BUG-ID: CSCsh48879

Detections

Analytics