VAR-200803-0023
Vulnerability from variot - Updated: 2025-04-10 20:35Multiple integer overflows in a "legacy serialization format" parser in AppKit in Apple Mac OS X 10.4.11 allows remote attackers to execute arbitrary code via a crafted serialized property list. Failed exploit attempts will result in a denial-of-service condition. Apple Mac OS X is prone to multiple security vulnerabilities. These issues affect Mac OS X and various applications, including AFP Client, AFP Server, AppKit, Application Firewall, CoreFoundation, CoreServices, CUPS, Foundation, Help Viewer, Image Raw, libc, mDNSResponder, notifyd, pax archive utility, Podcast Producer, Preview, Printing, System Configuration, UDF, and Wiki Server. Attackers may exploit these issues to execute arbitrary code, trigger denial-of-service conditions, escalate privileges, and potentially compromise vulnerable computers. These issues affect Apple Mac OS X 10.4.11, 10.4.11 Server, 10.5.2, 10.5.2 Server and earlier. NOTE: This BID is being retired. The following individual records have been created to fully document all the vulnerabilities that were described in this BID: 28320 Apple Mac OS X AFP Client 'afp://' URI Remote Code Execution Vulnerability CVE-2008-0044. 28323 Apple Mac OS X AFP Server Cross-Realm Authentication Bypass Vulnerability CVE-2008-0994 28388 Apple Mac OS X AppKit NSDocument API's Stack Based Buffer Overflow Vulnerability CVE-2008-0048 28340 Apple Mac OS X AppKit Bootstrap Namespace Local Privilege Escalation Vulnerability CVE-2008-0049 28358 Apple Mac OS X AppKit Legacy Serialization Kit Multiple Integer Overflow Vulnerabilities CVE-2008-0057 28364 Apple Mac OS X AppKit PPD File Stack Buffer Overflow Vulnerability CVE-2008-0997 28368 Apple Mac OS X Application Firewall German Translation Insecure Configuration Weakness CVE-2008-0046 28375 Apple Mac OS X CoreFoundation Time Zone Data Local Privilege Escalation Vulnerability CVE-2008-0051 28384 Apple Mac OS X CoreServices '.ief' Files Security Policy Violation Weakness CVE-2008-0052 28334 CUPS Multiple Unspecified Input Validation Vulnerabilities 28341 Apple Mac OS X Foundation 'NSSelectorFromString' Input Validation Vulnerability 28343 Apple Mac OS X Foundation NSFileManager Insecure Directory Local Privilege Escalation Vulnerability 28357 Apple Mac OS X Foundation 'NSFileManager' Stack-Based Buffer Overflow Vulnerability 28359 Apple Mac OS X Foundation 'NSURLConnection' Cache Management Race Condition Security Vulnerability 28363 Apple Mac OS X Image RAW Stack-Based Buffer Overflow Vulnerability 28367 Apple Mac OS X Foundation 'NSXML' XML File Processing Race Condition Security Vulnerability 28371 Apple Mac OS X Help Viewer Remote Applescript Code Execution Vulnerability 28374 Apple Mac OS X libc 'strnstr(3)' Off-By-One Denial of Service Vulnerability 28387 Apple Mac OS X Printing To PDF Insecure Encryption Weakness 28386 Apple Mac OS X Preview PDF Insecure Encryption Weakness 28389 Apple Mac OS X Universal Disc Format Remote Denial of Service Vulnerability 28385 Apple Mac OS X NetCfgTool Local Privilege Escalation Vulnerability 28365 Apple Mac OS X pax Archive Utility Remote Code Execution Vulnerability 28344 Apple Mac OS X Authenticated Print Queue Information Disclosure Vulnerability 28345 Apple Mac OS X 'notifyd' Local Denial of Service Vulnerability 28372 Apple Mac OS X Podcast Producer Podcast Capture Information Disclosure Vulnerability 28339 Apple Mac OS X mDNSResponderHelper Local Format String Vulnerability. There are multiple integer overflow vulnerabilities in the parser of the serial number format. If a specially crafted serialized property list is parsed, a heap overflow can be triggered, resulting in the execution of arbitrary instructions. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Cisco Security Advisory: Vulnerability in Cisco IOS with OSPF, MPLS VPN, and Supervisor 32, Supervisor 720, or Route Switch Processor 720
Advisory ID: cisco-sa-20080326-queue
http://www.cisco.com/warp/public/707/cisco-sa-20080326-queue.shtml
Revision 1.0
For Public Release 2008 March 26 1600 UTC (GMT)
Summary
Certain Cisco Catalyst 6500 Series and Cisco 7600 Router devices that run branches of Cisco IOS based on 12.2 can be vulnerable to a denial of service vulnerability that can prevent any traffic from entering an affected interface. For a device to be vulnerable, it must be configured for Open Shortest Path First (OSPF) Sham-Link and Multi Protocol Label Switching (MPLS) Virtual Private Networking (VPN). This vulnerability only affects Cisco Catalyst 6500 Series or Catalyst 7600 Series devices with the Supervisor Engine 32 (Sup32), Supervisor Engine 720 (Sup720) or Route Switch Processor 720 (RSP720) modules. The Supervisor 32, Supervisor 720, Supervisor 720-3B, Supervisor 720-3BXL, Route Switch Processor 720, Route Switch Processor 720-3C, and Route Switch Processor 720-3CXL are all potentially vulnerable.
The OSPF and MPLS VPNs are not enabled by default.
This advisory is posted at http://www.cisco.com/warp/public/707/cisco-sa-20080326-queue.shtml
Note: The March 26, 2008 publication includes five Security Advisories. The Advisories all affect Cisco IOS. Each Advisory lists the releases that correct the vulnerability described in the Advisory, and the Advisories also detail the releases that correct the vulnerabilities in all five Advisories. Please reference the following software table to find a release which fixes all published Security Advisories as of March 26th, 2008.
- March 26th bundled IOS Advisory Table http://www.cisco.com/warp/public/707/cisco-sa-20080326-bundle.shtml
Individual publication links are listed below:
-
Cisco IOS Virtual Private Dial-up Network Denial of Service Vulnerability http://www.cisco.com/warp/public/707/cisco-sa-20080326-pptp.shtml
-
Multiple DLSw Denial of Service Vulnerabilities in Cisco IOS http://www.cisco.com/warp/public/707/cisco-sa-20080326-dlsw.shtml
-
Cisco IOS User Datagram Protocol Delivery Issue For IPv4/IPv6 Dual-stack Routers http://www.cisco.com/warp/public/707/cisco-sa-20080326-IPv4IPv6.shtml
-
Vulnerability in Cisco IOS with OSPF, MPLS VPN, and Supervisor 32, Supervisor 720, or Route Switch Processor 720 http://www.cisco.com/warp/public/707/cisco-sa-20080326-queue.shtml
-
Cisco IOS Multicast Virtual Private Network (MVPN) Data Leak http://www.cisco.com/warp/public/707/cisco-sa-20080326-mvpn.shtml
Affected Products
Vulnerable Products +------------------
All Cisco products based on the Supervisor Engine 32 (Sup32), Supervisor Engine 720 (Sup720) or Route Switch Processor 720 (RSP720) are potentially vulnerable. Cisco Sup720 and RSP720 products have support for daughter cards that enhance their functionality. These daughter cards attach directly to the Sup720 or RSP720 and have names like PFC-3B, PFC-3BXL, PFC-3C, and PFC-3CXL. The product number of the Sup720 or RSP720 can change to reflect the daughter card that is installed, such as RSP720-3CXL.
Because the vulnerability affects the Sup720 and RSP720, all versions of the Sup720 or RSP720 are vulnerable, regardless of the daughter card that is installed.
- Cisco Catalyst 6500 Series devices with the Sup32, Sup720, Sup720-3B, or Sup720-3BXL
- Cisco 7600 Series devices with the Sup32, Sup720, Sup720-3B, or Sup720-3BXL
- Cisco 7600 Series devices with the RSP720, RSP720-3C, or RSP720-3CXL
- Cisco ME 6524 Ethernet Switch
Products Confirmed Not Vulnerable +--------------------------------
No other Cisco products are currently known to be affected by this vulnerability.
Cisco Bug ID CSCsf12082 was integrated into additional IOS releases that do not run on the vulnerable hardware, but only the platforms mentioned in the Vulnerable Products section above are affected by this vulnerability.
Details
Vulnerable Cisco devices, when configured for Multi Protocol Label Switching (MPLS) Virtual Private Networking (VPN) and Open Shortest Path First (OSPF) sham-link, can suffer from a blocked queue, memory leak and/or restart of the device
This vulnerability is documented in Cisco bug ID CSCsf12082, and has been assigned CVE ID CVE-2008-0057.
The following combination of hardware and software configuration must be present for the device to be vulnerable:
- Cisco Catalyst Sup32, Sup720, or RSP720 is present
- MPLS VPN is configured
- OSPF sham-link is configured
In order to determine whether you are running this feature, use the show running-config command and search for the address-family vpnv4 and area sham-link router configuration commands. The following command displays all configuration lines that meet the following criteria:
- Begins with the word "router," OR
- Includes "address-family vpnv4," OR
-
Includes "sham-link"
Router# show run | include ^router |address-family vpnv4|sham-link router bgp 1 address-family vpnv4 router ospf 1 vrf VRFNAME area 0 sham-link 192.168.1.1 192.168.100.1 Router#
For customers that run versions of IOS that support the section modifier, an additional option is available to view the relevant sections of the running configuration:
Router# show run | section ^router
router bgp 1
[snip]
address-family vpnv4
router ospf 1 vrf VRFNAME
area 0 sham-link 192.168.1.1 192.168.100.1
[snip]
If certain packets are received by a device that meets the above requirements, the input queue of the interface that receives these packets can become blocked, which can prohibit additional traffic from entering the interface and cause a denial of service condition. In addition to a potential blocked interface queue, the device can also suffer a memory leak or restart. In the event of a memory leak, the device is unable to forward traffic once available memory is depleted.
For more information on MPLS VPNs, please reference the following document:
http://www.cisco.com/en/US/docs/net_mgmt/vpn_solutions_center/1.1/user/guide/VPN_UG1.html
For more information on OSPF sham-links, please reference the following document:
http://www.cisco.com/en/US/docs/ios/12_2t/12_2t8/feature/guide/ospfshmk.html
Identifying a Memory Leak +------------------------
This vulnerability can manifest as a leak in the I/O memory pool. The following is an example of a system message that indicates an exhaustion of the I/O pool:
006029: Aug 10: %SYS-2-MALLOCFAIL: Memory allocation of 808 bytes failed from 0x41613238, alignment 32
Pool: I/O Free: 176 Cause: Not enough free memory
Alternate Pool: None Free: 0 Cause: No Alternate pool
Note that in the above output, the affected memory pool is Pool: I/O, and the cause is Cause: Not enough free memory. This output indicates that the I/O memory pool has been exhausted.
Additionally, a user with enable-level access can check the device through the show buffers command to identify buffer allocation failures.
Router#show buffers
Buffer elements:
496 in free list (500 max allowed)
77298300 hits, 0 misses, 0 created
Public buffer pools:
Small buffers, 104 bytes (total 148654, permanent 1024, peak 148654 @ 1d12h):
0 in free list (128 min, 2048 max allowed)
24688031 hits, 4023203 misses, 0 trims, 147630 created
3243434 failures (3182828 no memory)
The above output shows that buffer allocation failed due to insufficient memory.
Identifying a Blocked Interface +------------------------------
A symptom of this type of blocked queue is the failure of control-plane protocols such as routing protocols (OSPF, Enhanced Interior Gateway Routing Protocol (EIGRP), Border Gateway Protocol (BGP), Intermediate System to Intermediate System (ISIS), etc.) and MPLS TDP/LDP to properly establish connections over an affected interface.
In order to identify a blocked input interface, issue the show interfaces command, and search for the Input Queue line. The size of the input queue can continue to increase. If the current size, which is 76 in the example below, is larger than the maximum size (75), the input queue is blocked.
It is possible that a device receives a high rate of traffic destined to the control plane, and the full queue is only a transient event. In order to verify if the interface is actually blocked, shut down the interface with the shutdown interface configuration command and examine the input queue. If the input queue does not display 0 packets, the interface is blocked.
Router#show interface ethernet 0/0
Ethernet0/0 is up, line protocol is up
Hardware is AmdP2, address is 0050.500e.f1e0 (bia 0050.500e.f1e0)
Internet address is 172.16.1.9/24
MTU 1500 bytes, BW 10000 Kbit, DLY 1000 usec, rely 255/255, load 1/255
Encapsulation ARPA, loopback not set, keepalive set (10 sec)
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:41, output 00:00:07, output hang never
Last clearing of "show interface" counters 00:07:18
Input queue: 76/75/1091/0 (size/max/drops/flushes); Total output drops: 0
!--- The 76/75 shows that this is blocked
Vulnerability Scoring Details
Cisco has provided scores for the vulnerabilities in this advisory based on the Common Vulnerability Scoring System (CVSS). The CVSS scoring in this Security Advisory is done in accordance with CVSS Version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability severity and helps determine urgency and priority of response.
Cisco has provided a base and temporal score. Customers can then compute environmental scores to assist in determining the impact of the vulnerability in individual networks.
Cisco has provided an FAQ to answer additional questions regarding CVSS at http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to help compute the environmental impact for individual networks at http://intellishield.cisco.com/security/alertmanager/cvss
CSCsf12082 - SUP720 facing small buffer leak and crashes
CVSS Base Score - 7.8
Access Vector: Network Access Complexity: Low Authentication: None
Confidentiality Impact: None Integrity Impact: None Availability Impact: Complete
CVSS Temporal Score - 6.1
Exploitability: Proof-of-Concept Remediation Level: Official-Fix Report Confidence: Confirmed
Impact
Exploitation of this vulnerability may result in a blocked interface input queue, memory leak, and/or restart of the device. Repeated exploitation of this vulnerability may result in an extended denial of service.
Software Versions and Fixes
When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider for assistance.
Each row of the Cisco IOS software table (below) names a Cisco IOS release train. If a given release train is vulnerable, then the earliest possible releases that contain the fix (along with the anticipated date of availability for each, if applicable) are listed in the "First Fixed Release" column of the table. The "Recommended Release" column indicates the releases which have fixes for all the published vulnerabilities at the time of this Advisory. A device running a release in the given train that is earlier than the release in a specific column (less than the First Fixed Release) is known to be vulnerable. Cisco recommends upgrading to a release equal to or later than the release in the "Recommended Releases" column of the table.
+----------------------------------------+ | Major | Availability of Repaired | | Release | Releases | |------------+---------------------------| | Affected | First Fixed | Recommended | | 12.0-Based | Release | Release | | Releases | | | |----------------------------------------| | There are no affected 12.0 based | | releases | |----------------------------------------| | Affected | First Fixed | Recommended | | 12.1-Based | Release | Release | | Releases | | | |----------------------------------------| | There are no affected 12.1 based | | releases | |----------------------------------------| | Affected | First Fixed | Recommended | | 12.2-Based | Release | Release | | Releases | | | |------------+-------------+-------------| | 12.2 | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2B | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2BC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2BW | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2BY | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2BZ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2CX | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2CY | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2CZ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2DA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2DD | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2DX | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2EU | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2EW | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2EWA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2EX | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2EY | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2EZ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2FX | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2FY | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2FZ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2IXA | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | 12.2IXB | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | 12.2IXC | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | 12.2IXD | Vulnerable; | | | | contact TAC | | |------------+-------------+-------------| | | Vulnerable; | 12.2(18) | | | migrate to | IXF; | | 12.2IXE | any release | Available | | | in 12.2IXF | on | | | | 31-MAR-2008 | |------------+-------------+-------------| | 12.2JA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2JK | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2MB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2MC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2S | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SBC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SCA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SE | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SEA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SEB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SEC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SED | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SEE | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SEF | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SEG | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SG | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SGA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SL | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SM | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SO | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SRA | 12.2(33) | 12.2(33) | | | SRA4 | SRA7 | |------------+-------------+-------------| | 12.2SRB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SRC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SU | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SV | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SVA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SVC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SVD | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SW | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SX | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | 12.2(18) | | 12.2SXA | first fixed | SXF13 | | | in 12.2SXF | | |------------+-------------+-------------| | | Vulnerable; | 12.2(18) | | 12.2SXB | first fixed | SXF13 | | | in 12.2SXF | | |------------+-------------+-------------| | | Vulnerable; | 12.2(18) | | 12.2SXD | first fixed | SXF13 | | | in 12.2SXF | | |------------+-------------+-------------| | | Vulnerable; | 12.2(18) | | 12.2SXE | first fixed | SXF13 | | | in 12.2SXF | | |------------+-------------+-------------| | 12.2SXF | 12.2(18) | 12.2(18) | | | SXF6 | SXF13 | |------------+-------------+-------------| | 12.2SXH | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SY | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2SZ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2T | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2TPC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2UZ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XD | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XE | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XF | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XG | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XH | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XI | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XJ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XK | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XL | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XM | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XN | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XO | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XQ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XR | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XS | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XT | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XU | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XV | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2XW | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YD | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YE | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YF | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YG | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YH | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YJ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YK | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YL | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YM | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YN | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YO | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YP | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YQ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YR | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YS | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YT | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YU | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YV | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YW | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YX | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YY | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2YZ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2ZA | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2ZB | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2ZC | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2ZD | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2ZE | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2ZF | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2ZG | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2ZH | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2ZJ | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2ZL | Not | | | | Vulnerable | | |------------+-------------+-------------| | 12.2ZP | Not | | | | Vulnerable | | |------------+-------------+-------------| | | Vulnerable; | | | 12.2ZU | migrate to | 12.2(33) | | | any release | SXH2 | | | in 12.2SXH | | |------------+-------------+-------------| | 12.2ZY | Not | | | | Vulnerable | | |------------+-------------+-------------| | Affected | First Fixed | Recommended | | 12.3-Based | Release | Release | | Releases | | | |----------------------------------------| | There are no affected 12.3 based | | releases | |----------------------------------------| | Affected | First Fixed | Recommended | | 12.4-Based | Release | Release | | Releases | | | |----------------------------------------| | There are no affected 12.4 based | | releases | +----------------------------------------+
Workarounds
Once a device interface queue has been exhausted, only a device restart can clear OSPF packets in the blocked queue.
Due to the manner in which these packets are processed, the queue block occurs prior to the OSPF MD5 check. The OSPF MD5 configuration does not protect a device from this vulnerability.
Increasing the Selective Packet Discard (SPD) Headroom +-----------------------------------------------------
At the most basic level, the Selective Packet Discard (SPD) provides extended buffering for control plane traffic. Known as the SPD headroom, this additional queue depth is typically reserved for traffic with IP Precedence equal to 6 (such as BGP), the Connectionless Network Service (CLNS) based routing protocol Intermediate System-to-Intermediate System (IS-IS), OSPF, and Layer 2 keepalives.
Increasing the SPD headroom provides additional buffering for OSPF packets. In the event of a blocked queue, the SPD headroom can be increased to allow more control plane traffic buffer space.
More information on SPD can be found in the following white paper:
http://www.cisco.com/web/about/security/intelligence/spd.html
It is possible to expand the queue size to accommodate more packets, but packets can still accumulate until the expanded queue is exhausted. As a temporary workaround that allows traffic to continue to flow, the input hold queue can be increased. Any additional malformed packets still fill the queue, but increasing the input queue depth can extend the amount of time before the input queue fills and traffic ceases flowing. The following example demonstrates how to set the input queue size from the default of 75 to the maximum of 4096:
Router# configure terminal
Router(configure)# interface FastEthernet 0/0
Router(config-if)# hold-queue 4096 in
Removing OSPF Sham-Link Configuration +------------------------------------
Because OSPF Sham-Link configuration is required for the vulnerability to be present, removing Sham-Link functionality eliminates exposure to this vulnerability. In order to remove the OSPF Sham-Link configuration from a device, the OSPF configuration must be changed on each interface where Sham-Link is configured.
For configuration information on OSPF Sham-Link, please consult the following document:
http://www.cisco.com/en/US/docs/ios/12_2t/12_2t8/feature/guide/ospfshmk.html
Cisco IOS Embedded Event Manager +-------------------------------
Cisco IOS Embedded Event Manager (EEM) provides event detection and reaction capabilities on a Cisco IOS device. It is possible to detect blocked interface queues with an EEM policy. EEM can alert administrators of blocked interfaces with email, a syslog message, or a Simple Network Management Protocol (SNMP) trap.
A sample EEM policy that uses syslog to alert administrators of blocked interfaces is available at Cisco Beyond, an online community dedicated to EEM. A sample script is available at the following link:
http://forums.cisco.com/eforum/servlet/EEM?page=eem&fn=script&scriptId=981
More information about EEM is available from Cisco.com at the following link:
http://www.cisco.com/en/US/products/ps6815/products_ios_protocol_group_home.html
Obtaining Fixed Software
Cisco has released free software updates that address this vulnerability. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment.
Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/en/US/products/prod_warranties_item09186a008088e31f.html or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml.
Do not contact psirt@cisco.com or security-alert@cisco.com for software upgrades.
Customers with Service Contracts +-------------------------------
Customers with contracts should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com.
Customers using Third Party Support Organizations +------------------------------------------------
Customers whose Cisco products are provided or maintained through prior or existing agreements with third-party support organizations, such as Cisco Partners, authorized resellers, or service providers should contact that support organization for guidance and assistance with the appropriate course of action in regards to this advisory.
The effectiveness of any workaround or fix is dependent on specific customer situations, such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround or fix is the most appropriate for use in the intended network before it is deployed.
Customers without Service Contracts +----------------------------------
Customers who purchase direct from Cisco but do not hold a Cisco service contract, and customers who purchase through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should acquire upgrades by contacting the Cisco Technical Assistance Center (TAC). TAC contacts are as follows.
- +1 800 553 2447 (toll free from within North America)
- +1 408 526 7209 (toll call from anywhere in the world)
- e-mail: tac@cisco.com
Customers should have their product serial number available and be prepared to give the URL of this notice as evidence of entitlement to a free upgrade. Free upgrades for non-contract customers must be requested through the TAC.
Refer to http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml for additional TAC contact information, including localized telephone numbers, and instructions and e-mail addresses for use in various languages.
Exploitation and Public Announcements
The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory.
This vulnerability was reported to Cisco by a customer.
Status of this Notice: FINAL
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors.
Distribution
This advisory is posted on Cisco's worldwide website at :
http://www.cisco.com/warp/public/707/cisco-sa-20080326-queue.shtml
In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients.
- cust-security-announce@cisco.com
- first-teams@first.org
- bugtraq@securityfocus.com
- vulnwatch@vulnwatch.org
- cisco@spot.colorado.edu
- cisco-nsp@puck.nether.net
- full-disclosure@lists.grok.org.uk
- comp.dcom.sys.cisco@newsgate.cisco.com
Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates.
Revision History
+---------------------------------------+ | Revision | | Initial | | 1.0 | 2008-March-26 | public | | | | release. | +---------------------------------------+
Cisco Security Procedures
Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html. This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin)
iEYEARECAAYFAkfqb/IACgkQ86n/Gc8U/uDSVQCcD/eTXkZUyMzZERQXt+d9DhGD dKgAnjQ+Gsmkh4/x1l5K8q2E9QKUJN1d =xTuf -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200803-0023",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "mac os x",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "10.4.11"
},
{
"model": "mac os x server",
"scope": "eq",
"trust": 1.6,
"vendor": "apple",
"version": "10.4.11"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "v10.4.11"
},
{
"model": "mac os x server",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "v10.4.11"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "x10.4.11"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "x10.4.10"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "x10.4.9"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "x10.4.8"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "x10.4.7"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "x10.4.6"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "x10.4.5"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "x10.4.4"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "x10.4.3"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "x10.4.2"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "x10.4.1"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "x10.4"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "x10.4.11"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "x10.4.10"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "x10.4.9"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "x10.4.8"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "x10.4.7"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "x10.4.6"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "x10.4.5"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "x10.4.4"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "x10.4.3"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "x10.4.2"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "x10.4.1"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.6,
"vendor": "apple",
"version": "x10.4"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.8"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.1.1"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.5"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.2"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.0.4"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.9"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.1.2"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.4"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.6"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.6"
},
{
"model": "directory pro",
"scope": "eq",
"trust": 0.3,
"vendor": "cosmicperl",
"version": "10.0.3"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.1"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5.1"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.1"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.7"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.03"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.1"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.8"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.1.4"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.1.3"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.7"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.4"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.2"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.3"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.5"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.0"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.1.5"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.3"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5.2"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.8"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.5"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.0.1"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.1.1"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.2"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.1.2"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.9"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.6"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.6"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5.1"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.7"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.0.2"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.1"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.0.3"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.1"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.1"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.7"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.8"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.1.4"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.1.3"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.4"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.5"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.2"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.4"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.3.3"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.0"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.2.3"
},
{
"model": "mac os",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.5.2"
},
{
"model": "mac os server",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "x10.1.5"
}
],
"sources": [
{
"db": "BID",
"id": "28358"
},
{
"db": "BID",
"id": "28304"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001215"
},
{
"db": "CNNVD",
"id": "CNNVD-200803-267"
},
{
"db": "NVD",
"id": "CVE-2008-0057"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:apple:mac_os_x",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:apple:mac_os_x_server",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2008-001215"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Ragnar SundbladregenrechtDaniel JalkutBrian MastenbrookClint RuohoMike Ash",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200803-267"
}
],
"trust": 0.6
},
"cve": "CVE-2008-0057",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CVE-2008-0057",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "VHN-30182",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2008-0057",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2008-0057",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-200803-267",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-30182",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-30182"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001215"
},
{
"db": "CNNVD",
"id": "CNNVD-200803-267"
},
{
"db": "NVD",
"id": "CVE-2008-0057"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple integer overflows in a \"legacy serialization format\" parser in AppKit in Apple Mac OS X 10.4.11 allows remote attackers to execute arbitrary code via a crafted serialized property list. Failed exploit attempts will result in a denial-of-service condition. Apple Mac OS X is prone to multiple security vulnerabilities. \nThese issues affect Mac OS X and various applications, including AFP Client, AFP Server, AppKit, Application Firewall, CoreFoundation, CoreServices, CUPS, Foundation, Help Viewer, Image Raw, libc, mDNSResponder, notifyd, pax archive utility, Podcast Producer, Preview, Printing, System Configuration, UDF, and Wiki Server. \nAttackers may exploit these issues to execute arbitrary code, trigger denial-of-service conditions, escalate privileges, and potentially compromise vulnerable computers. \nThese issues affect Apple Mac OS X 10.4.11, 10.4.11 Server, 10.5.2, 10.5.2 Server and earlier. \nNOTE: This BID is being retired. The following individual records have been created to fully document all the vulnerabilities that were described in this BID:\n28320 Apple Mac OS X AFP Client \u0027afp://\u0027 URI Remote Code Execution Vulnerability CVE-2008-0044. \n28323 Apple Mac OS X AFP Server Cross-Realm Authentication Bypass Vulnerability CVE-2008-0994\n28388 Apple Mac OS X AppKit NSDocument API\u0027s Stack Based Buffer Overflow Vulnerability CVE-2008-0048\n28340 Apple Mac OS X AppKit Bootstrap Namespace Local Privilege Escalation Vulnerability CVE-2008-0049\n28358 Apple Mac OS X AppKit Legacy Serialization Kit Multiple Integer Overflow Vulnerabilities CVE-2008-0057\n28364 Apple Mac OS X AppKit PPD File Stack Buffer Overflow Vulnerability CVE-2008-0997\n28368 Apple Mac OS X Application Firewall German Translation Insecure Configuration Weakness CVE-2008-0046\n28375 Apple Mac OS X CoreFoundation Time Zone Data Local Privilege Escalation Vulnerability CVE-2008-0051\n28384 Apple Mac OS X CoreServices \u0027.ief\u0027 Files Security Policy Violation Weakness CVE-2008-0052\n28334 CUPS Multiple Unspecified Input Validation Vulnerabilities\n28341 Apple Mac OS X Foundation \u0027NSSelectorFromString\u0027 Input Validation Vulnerability\n28343 Apple Mac OS X Foundation NSFileManager Insecure Directory Local Privilege Escalation Vulnerability\n28357 Apple Mac OS X Foundation \u0027NSFileManager\u0027 Stack-Based Buffer Overflow Vulnerability\n28359 Apple Mac OS X Foundation \u0027NSURLConnection\u0027 Cache Management Race Condition Security Vulnerability\n28363 Apple Mac OS X Image RAW Stack-Based Buffer Overflow Vulnerability\n28367 Apple Mac OS X Foundation \u0027NSXML\u0027 XML File Processing Race Condition Security Vulnerability\n28371 Apple Mac OS X Help Viewer Remote Applescript Code Execution Vulnerability\n28374 Apple Mac OS X libc \u0027strnstr(3)\u0027 Off-By-One Denial of Service Vulnerability\n28387 Apple Mac OS X Printing To PDF Insecure Encryption Weakness\n28386 Apple Mac OS X Preview PDF Insecure Encryption Weakness\n28389 Apple Mac OS X Universal Disc Format Remote Denial of Service Vulnerability\n28385 Apple Mac OS X NetCfgTool Local Privilege Escalation Vulnerability\n28365 Apple Mac OS X pax Archive Utility Remote Code Execution Vulnerability\n28344 Apple Mac OS X Authenticated Print Queue Information Disclosure Vulnerability\n28345 Apple Mac OS X \u0027notifyd\u0027 Local Denial of Service Vulnerability\n28372 Apple Mac OS X Podcast Producer Podcast Capture Information Disclosure Vulnerability\n28339 Apple Mac OS X mDNSResponderHelper Local Format String Vulnerability. There are multiple integer overflow vulnerabilities in the parser of the serial number format. If a specially crafted serialized property list is parsed, a heap overflow can be triggered, resulting in the execution of arbitrary instructions. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\nCisco Security Advisory: Vulnerability in Cisco IOS with OSPF, MPLS\n VPN, and Supervisor 32, Supervisor 720, or\n Route Switch Processor 720\n\nAdvisory ID: cisco-sa-20080326-queue\n\nhttp://www.cisco.com/warp/public/707/cisco-sa-20080326-queue.shtml\n\nRevision 1.0\n\nFor Public Release 2008 March 26 1600 UTC (GMT)\n\nSummary\n=======\n\nCertain Cisco Catalyst 6500 Series and Cisco 7600 Router devices that\nrun branches of Cisco IOS based on 12.2 can be vulnerable to a denial\nof service vulnerability that can prevent any traffic from entering\nan affected interface. For a device to be vulnerable, it must be\nconfigured for Open Shortest Path First (OSPF) Sham-Link and Multi\nProtocol Label Switching (MPLS) Virtual Private Networking (VPN). \nThis vulnerability only affects Cisco Catalyst 6500 Series or\nCatalyst 7600 Series devices with the Supervisor Engine 32 (Sup32),\nSupervisor Engine 720 (Sup720) or Route Switch Processor 720 (RSP720)\nmodules. The Supervisor 32, Supervisor 720, Supervisor 720-3B,\nSupervisor 720-3BXL, Route Switch Processor 720, Route Switch\nProcessor 720-3C, and Route Switch Processor 720-3CXL are all\npotentially vulnerable. \n\nThe OSPF and MPLS VPNs are not enabled by default. \n\nThis advisory is posted at \nhttp://www.cisco.com/warp/public/707/cisco-sa-20080326-queue.shtml\n\nNote: The March 26, 2008 publication includes five Security\nAdvisories. The Advisories all affect Cisco IOS. Each Advisory lists\nthe releases that correct the vulnerability described in the\nAdvisory, and the Advisories also detail the releases that correct\nthe vulnerabilities in all five Advisories. Please reference the\nfollowing software table to find a release which fixes all published\nSecurity Advisories as of March 26th, 2008. \n\n * March 26th bundled IOS Advisory Table\n http://www.cisco.com/warp/public/707/cisco-sa-20080326-bundle.shtml\n\nIndividual publication links are listed below:\n\n * Cisco IOS Virtual Private Dial-up Network Denial of Service\n Vulnerability\n http://www.cisco.com/warp/public/707/cisco-sa-20080326-pptp.shtml\n \n * Multiple DLSw Denial of Service Vulnerabilities in Cisco IOS\n http://www.cisco.com/warp/public/707/cisco-sa-20080326-dlsw.shtml\n \n * Cisco IOS User Datagram Protocol Delivery Issue For IPv4/IPv6\n Dual-stack Routers\n http://www.cisco.com/warp/public/707/cisco-sa-20080326-IPv4IPv6.shtml\n\n * Vulnerability in Cisco IOS with OSPF, MPLS VPN, and Supervisor\n 32, Supervisor 720, or Route Switch Processor 720\n http://www.cisco.com/warp/public/707/cisco-sa-20080326-queue.shtml\n \n * Cisco IOS Multicast Virtual Private Network (MVPN) Data Leak\n http://www.cisco.com/warp/public/707/cisco-sa-20080326-mvpn.shtml\n\n\nAffected Products\n================\n\nVulnerable Products\n+------------------\n\nAll Cisco products based on the Supervisor Engine 32 (Sup32),\nSupervisor Engine 720 (Sup720) or Route Switch Processor 720 (RSP720)\nare potentially vulnerable. Cisco Sup720 and RSP720 products have\nsupport for daughter cards that enhance their functionality. These\ndaughter cards attach directly to the Sup720 or RSP720 and have names\nlike PFC-3B, PFC-3BXL, PFC-3C, and PFC-3CXL. The product number of\nthe Sup720 or RSP720 can change to reflect the daughter card that is\ninstalled, such as RSP720-3CXL. \n\nBecause the vulnerability affects the Sup720 and RSP720, all versions\nof the Sup720 or RSP720 are vulnerable, regardless of the daughter\ncard that is installed. \n\n * Cisco Catalyst 6500 Series devices with the Sup32, Sup720,\n Sup720-3B, or Sup720-3BXL\n * Cisco 7600 Series devices with the Sup32, Sup720, Sup720-3B, or\n Sup720-3BXL\n * Cisco 7600 Series devices with the RSP720, RSP720-3C, or\n RSP720-3CXL\n * Cisco ME 6524 Ethernet Switch\n\nProducts Confirmed Not Vulnerable\n+--------------------------------\n\nNo other Cisco products are currently known to be affected by this\nvulnerability. \n\nCisco Bug ID CSCsf12082 was integrated into additional IOS releases \nthat do not run on the vulnerable hardware, but only the platforms \nmentioned in the Vulnerable Products section above are affected by\nthis vulnerability. \n\nDetails\n=======\n\nVulnerable Cisco devices, when configured for Multi Protocol Label\nSwitching (MPLS) Virtual Private Networking (VPN) and Open Shortest\nPath First (OSPF) sham-link, can suffer from a blocked queue, \nmemory leak and/or restart of the device\n\nThis vulnerability is documented in Cisco bug ID CSCsf12082, and has \nbeen assigned CVE ID CVE-2008-0057. \n\nThe following combination of hardware and software configuration must\nbe present for the device to be vulnerable:\n\n * Cisco Catalyst Sup32, Sup720, or RSP720 is present\n * MPLS VPN is configured\n * OSPF sham-link is configured\n\nIn order to determine whether you are running this feature, use the \nshow running-config command and search for the address-family vpnv4\nand area sham-link router configuration commands. The following\ncommand displays all configuration lines that meet the following\ncriteria:\n\n * Begins with the word \"router,\" OR\n * Includes \"address-family vpnv4,\" OR\n * Includes \"sham-link\"\n\n Router# show run | include ^router |address-family vpnv4|sham-link\n router bgp 1\n address-family vpnv4\n router ospf 1 vrf VRFNAME\n area 0 sham-link 192.168.1.1 192.168.100.1\n Router# \n \nFor customers that run versions of IOS that support the section\nmodifier, an additional option is available to view the relevant\nsections of the running configuration:\n\n Router# show run | section ^router\n router bgp 1\n [snip]\n address-family vpnv4\n router ospf 1 vrf VRFNAME\n area 0 sham-link 192.168.1.1 192.168.100.1\n [snip]\n\nIf certain packets are received by a device that meets the above\nrequirements, the input queue of the interface that receives these\npackets can become blocked, which can prohibit additional traffic\nfrom entering the interface and cause a denial of service condition. \nIn addition to a potential blocked interface queue, the device can\nalso suffer a memory leak or restart. In the event of a memory leak,\nthe device is unable to forward traffic once available memory is\ndepleted. \n\nFor more information on MPLS VPNs, please reference the following\ndocument:\n\nhttp://www.cisco.com/en/US/docs/net_mgmt/vpn_solutions_center/1.1/user/guide/VPN_UG1.html\n\nFor more information on OSPF sham-links, please reference the\nfollowing document:\n\nhttp://www.cisco.com/en/US/docs/ios/12_2t/12_2t8/feature/guide/ospfshmk.html\n\nIdentifying a Memory Leak\n+------------------------\n\nThis vulnerability can manifest as a leak in the I/O memory pool. The\nfollowing is an example of a system message that indicates an\nexhaustion of the I/O pool:\n\n 006029: Aug 10: %SYS-2-MALLOCFAIL: Memory allocation of 808 bytes failed from 0x41613238, alignment 32 \n Pool: I/O Free: 176 Cause: Not enough free memory \n Alternate Pool: None Free: 0 Cause: No Alternate pool \n\nNote that in the above output, the affected memory pool is Pool: I/O,\nand the cause is Cause: Not enough free memory. This output indicates\nthat the I/O memory pool has been exhausted. \n\nAdditionally, a user with enable-level access can check the device\nthrough the show buffers command to identify buffer allocation\nfailures. \n\n Router#show buffers \n Buffer elements: \n 496 in free list (500 max allowed) \n 77298300 hits, 0 misses, 0 created \n \n Public buffer pools: \n Small buffers, 104 bytes (total 148654, permanent 1024, peak 148654 @ 1d12h): \n 0 in free list (128 min, 2048 max allowed) \n 24688031 hits, 4023203 misses, 0 trims, 147630 created \n 3243434 failures (3182828 no memory) \n\nThe above output shows that buffer allocation failed due to\ninsufficient memory. \n\nIdentifying a Blocked Interface\n+------------------------------\n\nA symptom of this type of blocked queue is the failure of\ncontrol-plane protocols such as routing protocols (OSPF, Enhanced\nInterior Gateway Routing Protocol (EIGRP), Border Gateway Protocol\n(BGP), Intermediate System to Intermediate System (ISIS), etc.) and\nMPLS TDP/LDP to properly establish connections over an affected\ninterface. \n\nIn order to identify a blocked input interface, issue the show\ninterfaces command, and search for the Input Queue line. The size of\nthe input queue can continue to increase. If the current size, which\nis 76 in the example below, is larger than the maximum size (75), the\ninput queue is blocked. \n\nIt is possible that a device receives a high rate of traffic destined\nto the control plane, and the full queue is only a transient event. \nIn order to verify if the interface is actually blocked, shut down\nthe interface with the shutdown interface configuration command and\nexamine the input queue. If the input queue does not display 0\npackets, the interface is blocked. \n\n Router#show interface ethernet 0/0\n Ethernet0/0 is up, line protocol is up \n Hardware is AmdP2, address is 0050.500e.f1e0 (bia 0050.500e.f1e0) \n Internet address is 172.16.1.9/24\n MTU 1500 bytes, BW 10000 Kbit, DLY 1000 usec, rely 255/255, load 1/255\n Encapsulation ARPA, loopback not set, keepalive set (10 sec)\n ARP type: ARPA, ARP Timeout 04:00:00 \n Last input 00:00:41, output 00:00:07, output hang never\n Last clearing of \"show interface\" counters 00:07:18\n Input queue: 76/75/1091/0 (size/max/drops/flushes); Total output drops: 0 \n \n \n !--- The 76/75 shows that this is blocked\n \n\nVulnerability Scoring Details\n=============================\n\nCisco has provided scores for the vulnerabilities in this advisory\nbased on the Common Vulnerability Scoring System (CVSS). The CVSS\nscoring in this Security Advisory is done in accordance with CVSS\nVersion 2.0. \n\nCVSS is a standards-based scoring method that conveys vulnerability\nseverity and helps determine urgency and priority of response. \n\nCisco has provided a base and temporal score. Customers can then\ncompute environmental scores to assist in determining the impact of\nthe vulnerability in individual networks. \n\nCisco has provided an FAQ to answer additional questions regarding\nCVSS at\nhttp://www.cisco.com/web/about/security/intelligence/cvss-qandas.html\n\nCisco has also provided a CVSS calculator to help compute the\nenvironmental impact for individual networks at\nhttp://intellishield.cisco.com/security/alertmanager/cvss \n\nCSCsf12082 - SUP720 facing small buffer leak and crashes\n\n CVSS Base Score - 7.8\n\n Access Vector: Network\n Access Complexity: Low\n Authentication: None\n\n Confidentiality Impact: None\n Integrity Impact: None\n Availability Impact: Complete\n\n CVSS Temporal Score - 6.1\n\n Exploitability: Proof-of-Concept\n Remediation Level: Official-Fix\n Report Confidence: Confirmed\n\nImpact\n======\n\nExploitation of this vulnerability may result in a blocked interface\ninput queue, memory leak, and/or restart of the device. Repeated\nexploitation of this vulnerability may result in an extended denial\nof service. \n\nSoftware Versions and Fixes\n===========================\n\nWhen considering software upgrades, also consult \nhttp://www.cisco.com/go/psirt and any subsequent advisories to \ndetermine exposure and a complete upgrade solution. \n\nIn all cases, customers should exercise caution to be certain the\ndevices to be upgraded contain sufficient memory and that current\nhardware and software configurations will continue to be supported\nproperly by the new release. If the information is not clear, contact\nthe Cisco Technical Assistance Center (TAC) or your contracted\nmaintenance provider for assistance. \n\nEach row of the Cisco IOS software table (below) names a Cisco IOS\nrelease train. If a given release train is vulnerable, then the\nearliest possible releases that contain the fix (along with the\nanticipated date of availability for each, if applicable) are listed\nin the \"First Fixed Release\" column of the table. The \"Recommended\nRelease\" column indicates the releases which have fixes for all the\npublished vulnerabilities at the time of this Advisory. A device\nrunning a release in the given train that is earlier than the release\nin a specific column (less than the First Fixed Release) is known to\nbe vulnerable. Cisco recommends upgrading to a release equal to or\nlater than the release in the \"Recommended Releases\" column of the\ntable. \n\n+----------------------------------------+\n| Major | Availability of Repaired |\n| Release | Releases |\n|------------+---------------------------|\n| Affected | First Fixed | Recommended |\n| 12.0-Based | Release | Release |\n| Releases | | |\n|----------------------------------------|\n| There are no affected 12.0 based |\n| releases |\n|----------------------------------------|\n| Affected | First Fixed | Recommended |\n| 12.1-Based | Release | Release |\n| Releases | | |\n|----------------------------------------|\n| There are no affected 12.1 based |\n| releases |\n|----------------------------------------|\n| Affected | First Fixed | Recommended |\n| 12.2-Based | Release | Release |\n| Releases | | |\n|------------+-------------+-------------|\n| 12.2 | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2B | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2BC | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2BW | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2BY | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2BZ | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2CX | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2CY | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2CZ | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2DA | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2DD | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2DX | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2EU | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2EW | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2EWA | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2EX | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2EY | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2EZ | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2FX | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2FY | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2FZ | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2IXA | Vulnerable; | |\n| | contact TAC | |\n|------------+-------------+-------------|\n| 12.2IXB | Vulnerable; | |\n| | contact TAC | |\n|------------+-------------+-------------|\n| 12.2IXC | Vulnerable; | |\n| | contact TAC | |\n|------------+-------------+-------------|\n| 12.2IXD | Vulnerable; | |\n| | contact TAC | |\n|------------+-------------+-------------|\n| | Vulnerable; | 12.2(18) |\n| | migrate to | IXF; |\n| 12.2IXE | any release | Available |\n| | in 12.2IXF | on |\n| | | 31-MAR-2008 |\n|------------+-------------+-------------|\n| 12.2JA | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2JK | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2MB | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2MC | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2S | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2SB | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2SBC | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2SCA | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2SE | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2SEA | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2SEB | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2SEC | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2SED | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2SEE | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2SEF | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2SEG | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2SG | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2SGA | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2SL | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2SM | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2SO | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2SRA | 12.2(33) | 12.2(33) |\n| | SRA4 | SRA7 |\n|------------+-------------+-------------|\n| 12.2SRB | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2SRC | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2SU | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2SV | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2SVA | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2SVC | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2SVD | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2SW | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2SX | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| | Vulnerable; | 12.2(18) |\n| 12.2SXA | first fixed | SXF13 |\n| | in 12.2SXF | |\n|------------+-------------+-------------|\n| | Vulnerable; | 12.2(18) |\n| 12.2SXB | first fixed | SXF13 |\n| | in 12.2SXF | |\n|------------+-------------+-------------|\n| | Vulnerable; | 12.2(18) |\n| 12.2SXD | first fixed | SXF13 |\n| | in 12.2SXF | |\n|------------+-------------+-------------|\n| | Vulnerable; | 12.2(18) |\n| 12.2SXE | first fixed | SXF13 |\n| | in 12.2SXF | |\n|------------+-------------+-------------|\n| 12.2SXF | 12.2(18) | 12.2(18) |\n| | SXF6 | SXF13 |\n|------------+-------------+-------------|\n| 12.2SXH | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2SY | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2SZ | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2T | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2TPC | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2UZ | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2XA | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2XB | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2XC | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2XD | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2XE | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2XF | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2XG | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2XH | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2XI | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2XJ | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2XK | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2XL | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2XM | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2XN | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2XO | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2XQ | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2XR | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2XS | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2XT | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2XU | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2XV | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2XW | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2YA | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2YB | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2YC | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2YD | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2YE | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2YF | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2YG | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2YH | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2YJ | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2YK | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2YL | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2YM | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2YN | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2YO | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2YP | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2YQ | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2YR | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2YS | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2YT | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2YU | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2YV | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2YW | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2YX | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2YY | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2YZ | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2ZA | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2ZB | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2ZC | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2ZD | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2ZE | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2ZF | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2ZG | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2ZH | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2ZJ | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2ZL | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| 12.2ZP | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| | Vulnerable; | |\n| 12.2ZU | migrate to | 12.2(33) |\n| | any release | SXH2 |\n| | in 12.2SXH | |\n|------------+-------------+-------------|\n| 12.2ZY | Not | |\n| | Vulnerable | |\n|------------+-------------+-------------|\n| Affected | First Fixed | Recommended |\n| 12.3-Based | Release | Release |\n| Releases | | |\n|----------------------------------------|\n| There are no affected 12.3 based |\n| releases |\n|----------------------------------------|\n| Affected | First Fixed | Recommended |\n| 12.4-Based | Release | Release |\n| Releases | | |\n|----------------------------------------|\n| There are no affected 12.4 based |\n| releases |\n+----------------------------------------+\n\nWorkarounds\n===========\n\nOnce a device interface queue has been exhausted, only a device\nrestart can clear OSPF packets in the blocked queue. \n\nDue to the manner in which these packets are processed, the queue\nblock occurs prior to the OSPF MD5 check. The OSPF MD5 configuration\ndoes not protect a device from this vulnerability. \n\nIncreasing the Selective Packet Discard (SPD) Headroom\n+-----------------------------------------------------\n\nAt the most basic level, the Selective Packet Discard (SPD) provides\nextended buffering for control plane traffic. Known as the SPD\nheadroom, this additional queue depth is typically reserved for\ntraffic with IP Precedence equal to 6 (such as BGP), the\nConnectionless Network Service (CLNS) based routing protocol\nIntermediate System-to-Intermediate System (IS-IS), OSPF, and Layer 2\nkeepalives. \n\nIncreasing the SPD headroom provides additional buffering for OSPF\npackets. In the event of a blocked queue, the SPD headroom can be\nincreased to allow more control plane traffic buffer space. \n\nMore information on SPD can be found in the following white paper:\n\nhttp://www.cisco.com/web/about/security/intelligence/spd.html\n\nIt is possible to expand the queue size to accommodate more packets,\nbut packets can still accumulate until the expanded queue is\nexhausted. As a temporary workaround that allows traffic to continue\nto flow, the input hold queue can be increased. Any additional\nmalformed packets still fill the queue, but increasing the input\nqueue depth can extend the amount of time before the input queue\nfills and traffic ceases flowing. The following example demonstrates\nhow to set the input queue size from the default of 75 to the maximum\nof 4096:\n\n Router# configure terminal\n Router(configure)# interface FastEthernet 0/0\n Router(config-if)# hold-queue 4096 in\n\nRemoving OSPF Sham-Link Configuration\n+------------------------------------\n\nBecause OSPF Sham-Link configuration is required for the\nvulnerability to be present, removing Sham-Link functionality\neliminates exposure to this vulnerability. In order to remove the\nOSPF Sham-Link configuration from a device, the OSPF configuration\nmust be changed on each interface where Sham-Link is configured. \n\nFor configuration information on OSPF Sham-Link, please consult the\nfollowing document:\n\nhttp://www.cisco.com/en/US/docs/ios/12_2t/12_2t8/feature/guide/ospfshmk.html\n\nCisco IOS Embedded Event Manager\n+-------------------------------\n\nCisco IOS Embedded Event Manager (EEM) provides event detection and\nreaction capabilities on a Cisco IOS device. It is possible to detect\nblocked interface queues with an EEM policy. EEM can alert\nadministrators of blocked interfaces with email, a syslog message, or\na Simple Network Management Protocol (SNMP) trap. \n\nA sample EEM policy that uses syslog to alert administrators of\nblocked interfaces is available at Cisco Beyond, an online community\ndedicated to EEM. A sample script is available at the following link:\n\nhttp://forums.cisco.com/eforum/servlet/EEM?page=eem\u0026fn=script\u0026scriptId=981\n\nMore information about EEM is available from Cisco.com at the\nfollowing link:\n\nhttp://www.cisco.com/en/US/products/ps6815/products_ios_protocol_group_home.html\n\nObtaining Fixed Software\n========================\n\nCisco has released free software updates that address this\nvulnerability. Prior to deploying software, customers should consult\ntheir maintenance provider or check the software for feature set\ncompatibility and known issues specific to their environment. \n\nCustomers may only install and expect support for the feature sets\nthey have purchased. By installing, downloading, accessing or\notherwise using such software upgrades, customers agree to be bound\nby the terms of Cisco\u0027s software license terms found at \nhttp://www.cisco.com/en/US/products/prod_warranties_item09186a008088e31f.html\nor as otherwise set forth at Cisco.com Downloads at \nhttp://www.cisco.com/public/sw-center/sw-usingswc.shtml. \n\nDo not contact psirt@cisco.com or security-alert@cisco.com for\nsoftware upgrades. \n\nCustomers with Service Contracts\n+-------------------------------\n\nCustomers with contracts should obtain upgraded software through\ntheir regular update channels. For most customers, this means that\nupgrades should be obtained through the Software Center on Cisco\u0027s\nworldwide website at http://www.cisco.com. \n\nCustomers using Third Party Support Organizations\n+------------------------------------------------\n\nCustomers whose Cisco products are provided or maintained through\nprior or existing agreements with third-party support organizations,\nsuch as Cisco Partners, authorized resellers, or service providers\nshould contact that support organization for guidance and assistance\nwith the appropriate course of action in regards to this advisory. \n\nThe effectiveness of any workaround or fix is dependent on specific\ncustomer situations, such as product mix, network topology, traffic\nbehavior, and organizational mission. Due to the variety of affected\nproducts and releases, customers should consult with their service\nprovider or support organization to ensure any applied workaround or\nfix is the most appropriate for use in the intended network before it\nis deployed. \n\nCustomers without Service Contracts\n+----------------------------------\n\nCustomers who purchase direct from Cisco but do not hold a Cisco\nservice contract, and customers who purchase through third-party\nvendors but are unsuccessful in obtaining fixed software through\ntheir point of sale should acquire upgrades by contacting the Cisco\nTechnical Assistance Center (TAC). TAC contacts are as follows. \n\n * +1 800 553 2447 (toll free from within North America)\n * +1 408 526 7209 (toll call from anywhere in the world)\n * e-mail: tac@cisco.com\n\nCustomers should have their product serial number available and be\nprepared to give the URL of this notice as evidence of entitlement to\na free upgrade. Free upgrades for non-contract customers must be\nrequested through the TAC. \n\nRefer to http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml\nfor additional TAC contact information, including localized telephone\nnumbers, and instructions and e-mail addresses for use in various\nlanguages. \n\nExploitation and Public Announcements\n=====================================\n\nThe Cisco PSIRT is not aware of any public announcements or malicious\nuse of the vulnerability described in this advisory. \n\nThis vulnerability was reported to Cisco by a customer. \n\nStatus of this Notice: FINAL\n============================\n\nTHIS DOCUMENT IS PROVIDED ON AN \"AS IS\" BASIS AND DOES NOT IMPLY ANY\nKIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF\nMERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE\nINFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS\nAT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS\nDOCUMENT AT ANY TIME. \n\nA stand-alone copy or Paraphrase of the text of this document that\nomits the distribution URL in the following section is an\nuncontrolled copy, and may lack important information or contain\nfactual errors. \n\nDistribution\n============\n\nThis advisory is posted on Cisco\u0027s worldwide website at :\n\nhttp://www.cisco.com/warp/public/707/cisco-sa-20080326-queue.shtml\n\nIn addition to worldwide web posting, a text version of this notice\nis clear-signed with the Cisco PSIRT PGP key and is posted to the\nfollowing e-mail and Usenet news recipients. \n\n * cust-security-announce@cisco.com\n * first-teams@first.org\n * bugtraq@securityfocus.com\n * vulnwatch@vulnwatch.org\n * cisco@spot.colorado.edu\n * cisco-nsp@puck.nether.net\n * full-disclosure@lists.grok.org.uk\n * comp.dcom.sys.cisco@newsgate.cisco.com\n\nFuture updates of this advisory, if any, will be placed on Cisco\u0027s\nworldwide website, but may or may not be actively announced on\nmailing lists or newsgroups. Users concerned about this problem are\nencouraged to check the above URL for any updates. \n\nRevision History\n================\n\n+---------------------------------------+\n| Revision | | Initial |\n| 1.0 | 2008-March-26 | public |\n| | | release. |\n+---------------------------------------+\n\nCisco Security Procedures\n=========================\n\nComplete information on reporting security vulnerabilities in Cisco\nproducts, obtaining assistance with security incidents, and\nregistering to receive security information from Cisco, is available\non Cisco\u0027s worldwide website at \nhttp://www.cisco.com/en/US/products/products_security_vulnerability_policy.html. \nThis includes instructions for press inquiries regarding Cisco \nsecurity notices. All Cisco security advisories are available at \nhttp://www.cisco.com/go/psirt. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.8 (Darwin)\n\niEYEARECAAYFAkfqb/IACgkQ86n/Gc8U/uDSVQCcD/eTXkZUyMzZERQXt+d9DhGD\ndKgAnjQ+Gsmkh4/x1l5K8q2E9QKUJN1d\n=xTuf\n-----END PGP SIGNATURE-----\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2008-0057"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001215"
},
{
"db": "BID",
"id": "28358"
},
{
"db": "BID",
"id": "28304"
},
{
"db": "VULHUB",
"id": "VHN-30182"
},
{
"db": "PACKETSTORM",
"id": "64921"
}
],
"trust": 2.34
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-30182",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-30182"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2008-0057",
"trust": 2.9
},
{
"db": "BID",
"id": "28358",
"trust": 2.8
},
{
"db": "BID",
"id": "28304",
"trust": 2.8
},
{
"db": "USCERT",
"id": "TA08-079A",
"trust": 2.5
},
{
"db": "SECTRACK",
"id": "1019648",
"trust": 2.5
},
{
"db": "VUPEN",
"id": "ADV-2008-0924",
"trust": 1.7
},
{
"db": "USCERT",
"id": "SA08-079A",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001215",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-200803-267",
"trust": 0.7
},
{
"db": "CERT/CC",
"id": "TA08-079A",
"trust": 0.6
},
{
"db": "APPLE",
"id": "APPLE-SA-2008-03-18",
"trust": 0.6
},
{
"db": "XF",
"id": "41298",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "64921",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-30182",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-30182"
},
{
"db": "BID",
"id": "28358"
},
{
"db": "BID",
"id": "28304"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001215"
},
{
"db": "PACKETSTORM",
"id": "64921"
},
{
"db": "CNNVD",
"id": "CNNVD-200803-267"
},
{
"db": "NVD",
"id": "CVE-2008-0057"
}
]
},
"id": "VAR-200803-0023",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-30182"
}
],
"trust": 0.01
},
"last_update_date": "2025-04-10T20:35:45.458000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Security Update 2008-002",
"trust": 0.8,
"url": "http://support.apple.com/kb/HT1249?viewlocale=en_US"
},
{
"title": "Security Update 2008-002",
"trust": 0.8,
"url": "http://support.apple.com/kb/HT1249?viewlocale=ja_JP"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2008-001215"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-189",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-30182"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001215"
},
{
"db": "NVD",
"id": "CVE-2008-0057"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "http://www.securityfocus.com/bid/28304"
},
{
"trust": 2.5,
"url": "http://www.securityfocus.com/bid/28358"
},
{
"trust": 2.5,
"url": "http://www.us-cert.gov/cas/techalerts/ta08-079a.html"
},
{
"trust": 2.5,
"url": "http://www.securitytracker.com/id?1019648"
},
{
"trust": 1.7,
"url": "http://lists.apple.com/archives/security-announce/2008/mar/msg00001.html"
},
{
"trust": 1.7,
"url": "http://docs.info.apple.com/article.html?artnum=307562"
},
{
"trust": 1.1,
"url": "http://www.vupen.com/english/advisories/2008/0924/references"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41298"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2008-0057"
},
{
"trust": 0.8,
"url": "http://www.frsirt.com/english/advisories/2008/0924"
},
{
"trust": 0.8,
"url": "http://jvn.jp/cert/jvnta08-079a/index.html"
},
{
"trust": 0.8,
"url": "http://jvn.jp/tr/trta08-079a/index.html"
},
{
"trust": 0.8,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2008-0057"
},
{
"trust": 0.8,
"url": "http://www.us-cert.gov/cas/alerts/sa08-079a.html"
},
{
"trust": 0.6,
"url": "http://xforce.iss.net/xforce/xfdb/41298"
},
{
"trust": 0.6,
"url": "http://www.frsirt.com/english/advisories/2008/0924/references"
},
{
"trust": 0.3,
"url": "http://software.cisco.com/download/navigator.html?mdfid=283613663"
},
{
"trust": 0.3,
"url": "http://www.apple.com/macosx/"
},
{
"trust": 0.3,
"url": "http://docs.info.apple.com/article.html?artnum=307430"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/en/us/docs/net_mgmt/vpn_solutions_center/1.1/user/guide/vpn_ug1.html"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/en/us/docs/ios/12_2t/12_2t8/feature/guide/ospfshmk.html"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/go/psirt"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/web/about/security/intelligence/spd.html"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/warp/public/707/cisco-sa-20080326-pptp.shtml"
},
{
"trust": 0.1,
"url": "http://forums.cisco.com/eforum/servlet/eem?page=eem\u0026fn=script\u0026scriptid=981"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/en/us/products/prod_warranties_item09186a008088e31f.html"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/en/us/products/products_security_vulnerability_policy.html."
},
{
"trust": 0.1,
"url": "http://www.cisco.com/warp/public/707/cisco-sa-20080326-queue.shtml"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/warp/public/707/cisco-sa-20080326-mvpn.shtml"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/go/psirt."
},
{
"trust": 0.1,
"url": "http://www.cisco.com/warp/public/707/cisco-sa-20080326-ipv4ipv6.shtml"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/warp/public/707/cisco-sa-20080326-dlsw.shtml"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/warp/public/707/cisco-sa-20080326-bundle.shtml"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2008-0057"
},
{
"trust": 0.1,
"url": "http://www.cisco.com."
},
{
"trust": 0.1,
"url": "http://www.cisco.com/public/sw-center/sw-usingswc.shtml."
},
{
"trust": 0.1,
"url": "http://www.cisco.com/en/us/products/ps6815/products_ios_protocol_group_home.html"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/warp/public/687/directory/dirtac.shtml"
},
{
"trust": 0.1,
"url": "http://intellishield.cisco.com/security/alertmanager/cvss"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-30182"
},
{
"db": "BID",
"id": "28358"
},
{
"db": "BID",
"id": "28304"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001215"
},
{
"db": "PACKETSTORM",
"id": "64921"
},
{
"db": "CNNVD",
"id": "CNNVD-200803-267"
},
{
"db": "NVD",
"id": "CVE-2008-0057"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-30182"
},
{
"db": "BID",
"id": "28358"
},
{
"db": "BID",
"id": "28304"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-001215"
},
{
"db": "PACKETSTORM",
"id": "64921"
},
{
"db": "CNNVD",
"id": "CNNVD-200803-267"
},
{
"db": "NVD",
"id": "CVE-2008-0057"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2008-03-18T00:00:00",
"db": "VULHUB",
"id": "VHN-30182"
},
{
"date": "2008-03-18T00:00:00",
"db": "BID",
"id": "28358"
},
{
"date": "2008-03-18T00:00:00",
"db": "BID",
"id": "28304"
},
{
"date": "2008-04-09T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2008-001215"
},
{
"date": "2008-03-26T22:24:02",
"db": "PACKETSTORM",
"id": "64921"
},
{
"date": "2008-03-18T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200803-267"
},
{
"date": "2008-03-18T22:44:00",
"db": "NVD",
"id": "CVE-2008-0057"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-08-08T00:00:00",
"db": "VULHUB",
"id": "VHN-30182"
},
{
"date": "2008-03-24T15:10:00",
"db": "BID",
"id": "28358"
},
{
"date": "2008-03-22T01:10:00",
"db": "BID",
"id": "28304"
},
{
"date": "2008-04-09T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2008-001215"
},
{
"date": "2008-10-11T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200803-267"
},
{
"date": "2025-04-09T00:30:58.490000",
"db": "NVD",
"id": "CVE-2008-0057"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "network",
"sources": [
{
"db": "BID",
"id": "28358"
},
{
"db": "BID",
"id": "28304"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Apple Mac OS X Multiple integer overflow vulnerabilities due to lack of parsing of traditional serialization format",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2008-001215"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "digital error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200803-267"
}
],
"trust": 0.6
}
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.