Cisco IOS multiple security vulnerabilities updated since 23.09.2009
Published:		24.09.2009
Source:		BUGTRAQ
SecurityVulns ID:		10258
Type:		remote
Level:		8/10
Description:		Multiple DoS conditions, restriction bypass.

Affected:		CISCO : IOS 12.0
		CISCO : IOS 12.1
		CISCO : IOS 12.2
		CISCO : IOS 12.3
		CISCO : IOS 12.4
		CISCO : IOS XE 2.1
		CISCO : IOS XE 2.2
		CISCO : IOS XE 2.3
		CISCO : IOS XE 2.4
CVE:		CVE-2009-2871 (Unspecified vulnerability in Cisco IOS 12.2 and 12.4, when SSLVPN sessions, SSH sessions, or IKE encrypted nonces are enabled, allows remote attackers to cause a denial of service (device reload) via a crafted encrypted packet, aka Bug ID CSCsq24002.)
		CVE-2009-2870 (Unspecified vulnerability in Cisco IOS 12.2 through 12.4, when the Cisco Unified Border Element feature is enabled, allows remote attackers to cause a denial of service (device reload) via crafted SIP messages, aka Bug ID CSCsx25880.)
		CVE-2009-2869 (Unspecified vulnerability in Cisco IOS 12.2XNA, 12.2XNB, 12.2XNC, 12.2XND, 12.4MD, 12.4T, 12.4XZ, and 12.4YA allows remote attackers to cause a denial of service (device reload) via a crafted NTPv4 packet, aka Bug IDs CSCsu24505 and CSCsv75948.)
		CVE-2009-2868 (Unspecified vulnerability in Cisco IOS 12.2 through 12.4, when certificate-based authentication is enabled for IKE, allows remote attackers to cause a denial of service (Phase 1 SA exhaustion) via crafted requests, aka Bug IDs CSCsy07555 and CSCee72997.)
		CVE-2009-2867 (Unspecified vulnerability in Cisco IOS 12.2XNA, 12.2XNB, 12.2XNC, 12.2XND, 12.4T, 12.4XZ, and 12.4YA, when Zone-Based Policy Firewall SIP Inspection is enabled, allows remote attackers to cause a denial of service (device reload) via a crafted SIP transit packet, aka Bug ID CSCsr18691.)
		CVE-2009-2866 (Unspecified vulnerability in Cisco IOS 12.2 through 12.4 allows remote attackers to cause a denial of service (device reload) via a crafted H.323 packet, aka Bug ID CSCsz38104.)
		CVE-2009-2862 (The Object Groups for Access Control Lists (ACLs) feature in Cisco IOS 12.2XNB, 12.2XNC, 12.2XND, 12.4MD, 12.4T, 12.4XZ, and 12.4YA allows remote attackers to bypass intended access restrictions via crafted requests, aka Bug IDs CSCsx07114, CSCsu70214, CSCsw47076, CSCsv48603, CSCsy54122, and CSCsu50252.)

Original document		CISCO, Cisco Security Advisory: Cisco Unified Communications Manager Express Vulnerability (24.09.2009)
		CISCO, Cisco Security Advisory: Cisco IOS Software Zone-Based Policy Firewall Vulnerability (23.09.2009)
		CISCO, Cisco Security Advisory: Cisco IOS Software Internet Key Exchange Resource Exhaustion Vulnerability (23.09.2009)
		CISCO, Cisco Security Advisory: Cisco IOS Software Crafted Encryption Packet Denial of Service Vulnerability (23.09.2009)
		CISCO, Cisco Security Advisory: Cisco IOS Software Object-group Access Control List Bypass Vulnerability (23.09.2009)
		CISCO, Cisco Security Advisory: Cisco IOS Software H.323 Denial of Service Vulnerability (23.09.2009)
		CISCO, Cisco Security Advisory: Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerability (23.09.2009)
		CISCO, Cisco Security Advisory: Cisco IOS Software Network Time Protocol Packet Vulnerability (23.09.2009)

Discuss:

Read or add your comments to this news (0 comments)