[SingCERT] Cisco IOS Data-Link Switching Vulnerability
- Published on Wednesday, 24 August 2011 18:11
[ Summary ]
Cisco IOS is prone to a remote denial-of-service vulnerability because of an unspecified error related to data-link switching. Attackers can exploit this issue by sending a series of specially-crafted packets within a narrow time frame.
1. An attacker locates a device using the vulnerable software.
2. The attacker constructs and submits a malicious packet designed to leverage the issue.
3. When the device tries to process the packet, a denial-of-service condition occurs.
Attackers can use readily available network tools to exploit this issue.
[ Affected Systems ]
This vulnerability affects Cisco IOS 12.2, 12.3, 12.4, 15.0, and 15.1.
[ Impact Analysis ]
Successfully exploiting this issue allows remote attackers to crash the affected device, denying service to legitimate users.
[ Solution/Workaround ]
Updates are available.
[ Reference ]