CVE-2016-6415

Опубликовано: 19 сент. 2016

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Критический

Описание

The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.x and 5.0.x through 5.2.x, and PIX before 7.0 allows remote attackers to obtain sensitive information from device memory via a Security Association (SA) negotiation request, aka Bug IDs CSCvb29204 and CSCvb36055 or BENIGNCERTAIN.

Ссылки

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160916-ikev1
Vendor Advisory
http://www.securityfocus.com/bid/93003
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1036841
Third Party Advisory
VDB Entry
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160916-ikev1
Vendor Advisory
http://www.securityfocus.com/bid/93003
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1036841
Third Party Advisory
VDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-6415

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:cisco:ios:*:*:*:*:*:*:*:*

Версия от 12.2 (включая) до 12.4 (включая)

cpe:2.3:o:cisco:ios:*:*:*:*:*:*:*:*

Версия от 15.0 (включая) до 15.6 (включая)

cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:*

Версия до 3.18s (включая)

cpe:2.3:o:cisco:ios_xr:*:*:*:*:*:*:*:*

Версия от 4.3.0 (включая) до 4.3.4 (включая)

cpe:2.3:o:cisco:ios_xr:*:*:*:*:*:*:*:*

Версия от 5.0.0 (включая) до 5.3.0 (исключая)

EPSS

Процентиль: 100%

0.92999

Критический

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-200

Связанные уязвимости

GHSA-ccm6-q86p-2hwx