CERTA-2005-AVI-454
Vulnerability from certfr_avis - Published: 2005-11-14 - Updated: 2005-11-14
Une vulnérabilité dans certains produits Cisco permet à un utilisateur distant mal intentionné de provoquer un déni de service.
Description
Une erreur dans la mise en œuvre de la première phase du protocole d'échange de clefs IKEv1 (Internet Key Exchange version 1) sur certains équipements Cisco permet à un utilisateur distant mal intentionné de provoquer un déni de service par le biais d'un message IKE malicieusement construit.
Solution
Se référer au bulletin de sécurité Cisco pour appliquer le correctif approprié (cf. Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | N/A | Cisco SAN-OS 2.x (commutateurs de la série MDS 9000) ; | ||
| Cisco | N/A | Cisco PIX 5.x ; | ||
| Cisco | IOS | Cisco IOS R12.x ; | ||
| Cisco | IOS | Cisco IOS 12.x ; | ||
| Cisco | N/A | Cisco SAN-OS 1.x (commutateurs de la série MDS 9000) ; | ||
| Cisco | N/A | Cisco Firewall Services Module 1.x ; | ||
| Cisco | N/A | Cisco PIX 6.x ; | ||
| Cisco | N/A | Cisco VPN 3000 Concentrator ; | ||
| Cisco | N/A | Cisco Firewall Services Module 2.x. | ||
| Cisco | N/A | Cisco PIX 7.x ; | ||
| Cisco | N/A | Cisco PIX 4.x ; |
References
| Title | Publication Time | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Cisco SAN-OS 2.x (commutateurs de la s\u00e9rie MDS 9000) ;",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco PIX 5.x ;",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS R12.x ;",
"product": {
"name": "IOS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS 12.x ;",
"product": {
"name": "IOS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco SAN-OS 1.x (commutateurs de la s\u00e9rie MDS 9000) ;",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Firewall Services Module 1.x ;",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco PIX 6.x ;",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco VPN 3000 Concentrator ;",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Firewall Services Module 2.x.",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco PIX 7.x ;",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco PIX 4.x ;",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Description\n\nUne erreur dans la mise en \u0153uvre de la premi\u00e8re phase du protocole\nd\u0027\u00e9change de clefs IKEv1 (Internet Key Exchange version 1) sur certains\n\u00e9quipements Cisco permet \u00e0 un utilisateur distant mal intentionn\u00e9 de\nprovoquer un d\u00e9ni de service par le biais d\u0027un message IKE\nmalicieusement construit.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 Cisco pour appliquer le correctif\nappropri\u00e9 (cf. Documentation).\n",
"cves": [],
"initial_release_date": "2005-11-14T00:00:00",
"last_revision_date": "2005-11-14T00:00:00",
"links": [
{
"title": "Site de l\u0027\u00e9diteur :",
"url": "http://www.cisco.com"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco #20051102-ipsec du 14 novembre 2005 :",
"url": "http://www.cisco.com/warp/public/707/cisco-sa-20051114-ipsec.shtml"
}
],
"reference": "CERTA-2005-AVI-454",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2005-11-14T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 dans certains produits Cisco permet \u00e0 un utilisateur\ndistant mal intentionn\u00e9 de provoquer un d\u00e9ni de service.\n",
"title": "Vuln\u00e9rabilit\u00e9 de certains produits Cisco",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco #20051114-ipsec du 14 novembre 2005",
"url": null
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…