var-201610-0299
Vulnerability from variot
Cisco IOS 12.2 through 12.4 and 15.0 through 15.6 and IOS XE 3.1 through 3.17 and 16.2 allow remote attackers to cause a denial of service (device reload) via crafted fields in an H.323 message, aka Bug ID CSCux04257. Both Cisco IOS and IOSXESoftware are operating systems developed by Cisco for its network devices. The vulnerability stems from a program failing to properly validate fields in the H.323 protocol suite. A remote attacker could exploit the vulnerability by accessing an invalid memory area to cause a denial of service (restart and crash). An attacker can exploit this issue to cause a denial-of-service condition. This issue is being tracked by Cisco Bug ID CSCux04257
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", affected_products: { "@id": "https://www.variotdbs.pl/ref/affected_products", }, configurations: { "@id": "https://www.variotdbs.pl/ref/configurations", }, credits: { "@id": "https://www.variotdbs.pl/ref/credits", }, cvss: { "@id": "https://www.variotdbs.pl/ref/cvss/", }, description: { "@id": "https://www.variotdbs.pl/ref/description/", }, exploit_availability: { "@id": "https://www.variotdbs.pl/ref/exploit_availability/", }, external_ids: { "@id": "https://www.variotdbs.pl/ref/external_ids/", }, iot: { "@id": "https://www.variotdbs.pl/ref/iot/", }, iot_taxonomy: { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/", }, patch: { "@id": "https://www.variotdbs.pl/ref/patch/", }, problemtype_data: { "@id": "https://www.variotdbs.pl/ref/problemtype_data/", }, references: { "@id": "https://www.variotdbs.pl/ref/references/", }, sources: { "@id": "https://www.variotdbs.pl/ref/sources/", }, sources_release_date: { "@id": "https://www.variotdbs.pl/ref/sources_release_date/", }, sources_update_date: { "@id": "https://www.variotdbs.pl/ref/sources_update_date/", }, threat_type: { "@id": "https://www.variotdbs.pl/ref/threat_type/", }, title: { "@id": "https://www.variotdbs.pl/ref/title/", }, type: { "@id": "https://www.variotdbs.pl/ref/type/", }, }, "@id": "https://www.variotdbs.pl/vuln/VAR-201610-0299", affected_products: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, "@id": "https://www.variotdbs.pl/ref/sources", }, }, data: [ { model: "ios xe", scope: "eq", trust: 1.8, vendor: "cisco", version: "16.2", }, { model: "ios", scope: "lte", trust: 1, vendor: "cisco", version: "15.6", }, { model: "ios xe", scope: "gte", trust: 1, vendor: "cisco", version: "3.1", }, { model: "ios", scope: "gte", trust: 1, vendor: "cisco", version: "12.2", }, { model: "ios", scope: "gte", trust: 1, vendor: "cisco", version: "15.0", }, { model: "ios", scope: "lte", trust: 1, vendor: "cisco", version: "12.4", }, { model: "ios xe", scope: "lte", trust: 1, vendor: "cisco", version: "3.17", }, { model: "ios", scope: "eq", trust: 0.8, vendor: "cisco", version: "12.2 to 12.4", }, { model: "ios", scope: "eq", trust: 0.8, vendor: "cisco", version: "15.0 to 15.6", }, { model: "ios xe", scope: "eq", trust: 0.8, vendor: "cisco", version: "3.1 to 3.17", }, { model: "ios", scope: null, trust: 0.6, vendor: "cisco", version: null, }, { model: "ios xe software", scope: null, trust: 0.6, vendor: "cisco", version: null, }, { model: "ios", scope: "eq", trust: 0.6, vendor: "cisco", version: "12.2\\(13\\)zd2", }, { model: "ios", scope: "eq", trust: 0.6, vendor: "cisco", version: "12.4\\(15\\)sw6", }, { model: "ios xe", scope: "eq", trust: 0.6, vendor: "cisco", version: "3.9.0s", }, { model: "ios xe", scope: "eq", trust: 0.6, vendor: "cisco", version: "3.14.0s", }, { model: "ios", scope: "eq", trust: 0.6, vendor: "cisco", version: "12.3\\(10d\\)", }, { model: "ios", scope: "eq", trust: 0.6, vendor: "cisco", version: "12.2\\(13\\)zd4", }, { model: "ios", scope: "eq", trust: 0.6, vendor: "cisco", version: "15.4\\(1\\)t1", }, { model: "ios", scope: "eq", trust: 0.6, vendor: "cisco", version: "12.2\\(15\\)cz1", }, { model: "ios", scope: "eq", trust: 0.6, vendor: "cisco", version: "12.3\\(2\\)xf", }, { model: "ios", scope: "eq", trust: 0.6, vendor: "cisco", version: "12.3\\(13a\\)", }, { model: "automation stratix", scope: "eq", trust: 0.3, vendor: "rockwell", version: "59000", }, { model: "ios xe software", scope: "eq", trust: 0.3, vendor: "cisco", version: "0", }, { model: "ios", scope: "eq", trust: 0.3, vendor: "cisco", version: "0", }, { model: "automation stratix", scope: "ne", trust: 0.3, vendor: "rockwell", version: "590015.6.3", }, ], sources: [ { db: "CNVD", id: "CNVD-2016-08397", }, { db: "BID", id: "93209", }, { db: "JVNDB", id: "JVNDB-2016-005152", }, { db: "NVD", id: "CVE-2016-6384", }, { db: "CNNVD", id: "CNNVD-201609-632", }, ], }, configurations: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", children: { "@container": "@list", }, cpe_match: { "@container": "@list", }, data: { "@container": "@list", }, nodes: { "@container": "@list", }, }, data: [ { CVE_data_version: "4.0", nodes: [ { children: [], cpe_match: [ { cpe23Uri: "cpe:2.3:o:cisco:ios:*:*:*:*:*:*:*:*", cpe_name: [], versionEndIncluding: "12.4", versionStartIncluding: "12.2", vulnerable: true, }, { cpe23Uri: "cpe:2.3:o:cisco:ios:*:*:*:*:*:*:*:*", cpe_name: [], versionEndIncluding: "15.6", versionStartIncluding: "15.0", vulnerable: true, }, { cpe23Uri: "cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:*", cpe_name: [], versionEndIncluding: "3.17", versionStartIncluding: "3.1", vulnerable: true, }, { cpe23Uri: "cpe:2.3:o:cisco:ios_xe:16.2:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, ], operator: "OR", }, ], }, ], sources: [ { db: "NVD", id: "CVE-2016-6384", }, ], }, credits: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "Cisco.", sources: [ { db: "BID", id: "93209", }, { db: "CNNVD", id: "CNNVD-201609-632", }, ], trust: 0.9, }, cve: "CVE-2016-6384", cvss: { "@context": { cvssV2: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#", }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2", }, cvssV3: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#", }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/", }, severity: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#", }, "@id": "https://www.variotdbs.pl/ref/cvss/severity", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, "@id": "https://www.variotdbs.pl/ref/sources", }, }, data: [ { cvssV2: [ { acInsufInfo: false, accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", author: "NVD", availabilityImpact: "COMPLETE", baseScore: 7.8, confidentialityImpact: "NONE", exploitabilityScore: 10, impactScore: 6.9, integrityImpact: "NONE", obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, severity: "HIGH", trust: 1, userInteractionRequired: false, vectorString: "AV:N/AC:L/Au:N/C:N/I:N/A:C", version: "2.0", }, { acInsufInfo: null, accessComplexity: "Low", accessVector: "Network", authentication: "None", author: "NVD", availabilityImpact: "Complete", baseScore: 7.8, confidentialityImpact: "None", exploitabilityScore: null, id: "CVE-2016-6384", impactScore: null, integrityImpact: "None", obtainAllPrivilege: null, obtainOtherPrivilege: null, obtainUserPrivilege: null, severity: "High", trust: 0.9, userInteractionRequired: null, vectorString: "AV:N/AC:L/Au:N/C:N/I:N/A:C", version: "2.0", }, { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", author: "CNVD", availabilityImpact: "COMPLETE", baseScore: 7.8, confidentialityImpact: "NONE", exploitabilityScore: 10, id: "CNVD-2016-08397", impactScore: 6.9, integrityImpact: "NONE", severity: "HIGH", trust: 0.6, vectorString: "AV:N/AC:L/Au:N/C:N/I:N/A:C", version: "2.0", }, { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", author: "VULHUB", availabilityImpact: "COMPLETE", baseScore: 7.8, confidentialityImpact: "NONE", exploitabilityScore: 10, id: "VHN-95204", impactScore: 6.9, integrityImpact: "NONE", severity: "HIGH", trust: 0.1, vectorString: "AV:N/AC:L/AU:N/C:N/I:N/A:C", version: "2.0", }, ], cvssV3: [ { attackComplexity: "LOW", attackVector: "NETWORK", author: "NVD", availabilityImpact: "HIGH", baseScore: 7.5, baseSeverity: "HIGH", confidentialityImpact: "NONE", exploitabilityScore: 3.9, impactScore: 3.6, integrityImpact: "NONE", privilegesRequired: "NONE", scope: "UNCHANGED", trust: 1, userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, { attackComplexity: "Low", attackVector: "Network", author: "NVD", availabilityImpact: "High", baseScore: 7.5, baseSeverity: "High", confidentialityImpact: "None", exploitabilityScore: null, id: "CVE-2016-6384", impactScore: null, integrityImpact: "None", privilegesRequired: "None", scope: "Unchanged", trust: 0.8, userInteraction: "None", vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.0", }, ], severity: [ { author: "NVD", id: "CVE-2016-6384", trust: 1.8, value: "HIGH", }, { author: "CNVD", id: "CNVD-2016-08397", trust: 0.6, value: "HIGH", }, { author: "CNNVD", id: "CNNVD-201609-632", trust: 0.6, value: "HIGH", }, { author: "VULHUB", id: "VHN-95204", trust: 0.1, value: "HIGH", }, { author: "VULMON", id: "CVE-2016-6384", trust: 0.1, value: "HIGH", }, ], }, ], sources: [ { db: "CNVD", id: "CNVD-2016-08397", }, { db: "VULHUB", id: "VHN-95204", }, { db: "VULMON", id: "CVE-2016-6384", }, { db: "JVNDB", id: "JVNDB-2016-005152", }, { db: "NVD", id: "CVE-2016-6384", }, { db: "CNNVD", id: "CNNVD-201609-632", }, ], }, description: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "Cisco IOS 12.2 through 12.4 and 15.0 through 15.6 and IOS XE 3.1 through 3.17 and 16.2 allow remote attackers to cause a denial of service (device reload) via crafted fields in an H.323 message, aka Bug ID CSCux04257. Both Cisco IOS and IOSXESoftware are operating systems developed by Cisco for its network devices. The vulnerability stems from a program failing to properly validate fields in the H.323 protocol suite. A remote attacker could exploit the vulnerability by accessing an invalid memory area to cause a denial of service (restart and crash). \nAn attacker can exploit this issue to cause a denial-of-service condition. \nThis issue is being tracked by Cisco Bug ID CSCux04257", sources: [ { db: "NVD", id: "CVE-2016-6384", }, { db: "JVNDB", id: "JVNDB-2016-005152", }, { db: "CNVD", id: "CNVD-2016-08397", }, { db: "BID", id: "93209", }, { db: "VULHUB", id: "VHN-95204", }, { db: "VULMON", id: "CVE-2016-6384", }, ], trust: 2.61, }, external_ids: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { db: "NVD", id: "CVE-2016-6384", trust: 3.5, }, { db: "BID", id: "93209", trust: 2.7, }, { db: "SECTRACK", id: "1036914", trust: 1.8, }, { db: "JVNDB", id: "JVNDB-2016-005152", trust: 0.8, }, { db: "CNNVD", id: "CNNVD-201609-632", trust: 0.7, }, { db: "CNVD", id: "CNVD-2016-08397", trust: 0.6, }, { db: "ICS CERT", id: "ICSA-17-094-04", trust: 0.4, }, { db: "VULHUB", id: "VHN-95204", trust: 0.1, }, { db: "VULMON", id: "CVE-2016-6384", trust: 0.1, }, ], sources: [ { db: "CNVD", id: "CNVD-2016-08397", }, { db: "VULHUB", id: "VHN-95204", }, { db: "VULMON", id: "CVE-2016-6384", }, { db: "BID", id: "93209", }, { db: "JVNDB", id: "JVNDB-2016-005152", }, { db: "NVD", id: "CVE-2016-6384", }, { db: "CNNVD", id: "CNNVD-201609-632", }, ], }, id: "VAR-201610-0299", iot: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: true, sources: [ { db: "CNVD", id: "CNVD-2016-08397", }, { db: "VULHUB", id: "VHN-95204", }, ], trust: 1.32263757, }, iot_taxonomy: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { category: [ "Network device", ], sub_category: null, trust: 0.6, }, ], sources: [ { db: "CNVD", id: "CNVD-2016-08397", }, ], }, last_update_date: "2023-12-18T11:50:32.824000Z", patch: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { title: "cisco-sa-20160928-h323", trust: 0.8, url: "http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20160928-h323", }, { title: "Patch for CiscoIOSandIOSXESoftware Denial of Service Vulnerability (CNVD-2016-08397)", trust: 0.6, url: "https://www.cnvd.org.cn/patchinfo/show/82008", }, { title: "Cisco IOS and IOS XE Software Remediation measures for denial of service vulnerabilities", trust: 0.6, url: "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=64405", }, { title: "Cisco: Cisco IOS and IOS XE Software H.323 Message Validation Denial of Service Vulnerability", trust: 0.1, url: "https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-20160928-h323", }, { title: "Threatpost", trust: 0.1, url: "https://threatpost.com/cisco-warns-of-critical-flaw-in-email-security-appliances/120968/", }, ], sources: [ { db: "CNVD", id: "CNVD-2016-08397", }, { db: "VULMON", id: "CVE-2016-6384", }, { db: "JVNDB", id: "JVNDB-2016-005152", }, { db: "CNNVD", id: "CNNVD-201609-632", }, ], }, problemtype_data: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { problemtype: "CWE-20", trust: 1.1, }, { problemtype: "CWE-399", trust: 0.9, }, ], sources: [ { db: "VULHUB", id: "VHN-95204", }, { db: "JVNDB", id: "JVNDB-2016-005152", }, { db: "NVD", id: "CVE-2016-6384", }, ], }, references: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { trust: 2.5, url: "http://www.securityfocus.com/bid/93209", }, { trust: 2.2, url: "http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20160928-h323", }, { trust: 1.8, url: "http://www.securitytracker.com/id/1036914", }, { trust: 0.8, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-6384", }, { trust: 0.8, url: "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-6384", }, { trust: 0.4, url: "https://ics-cert.us-cert.gov/advisories/icsa-17-094-04", }, { trust: 0.3, url: "http://www.cisco.com/", }, { trust: 0.3, url: "http://www.cisco.com/en/us/products/sw/iosswrel/products_ios_cisco_ios_software_category_home.html", }, { trust: 0.1, url: "https://cwe.mitre.org/data/definitions/20.html", }, { trust: 0.1, url: "https://nvd.nist.gov", }, { trust: 0.1, url: "https://threatpost.com/cisco-warns-of-critical-flaw-in-email-security-appliances/120968/", }, ], sources: [ { db: "CNVD", id: "CNVD-2016-08397", }, { db: "VULHUB", id: "VHN-95204", }, { db: "VULMON", id: "CVE-2016-6384", }, { db: "BID", id: "93209", }, { db: "JVNDB", id: "JVNDB-2016-005152", }, { db: "NVD", id: "CVE-2016-6384", }, { db: "CNNVD", id: "CNNVD-201609-632", }, ], }, sources: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", data: { "@container": "@list", }, }, data: [ { db: "CNVD", id: "CNVD-2016-08397", }, { db: "VULHUB", id: "VHN-95204", }, { db: "VULMON", id: "CVE-2016-6384", }, { db: "BID", id: "93209", }, { db: "JVNDB", id: "JVNDB-2016-005152", }, { db: "NVD", id: "CVE-2016-6384", }, { db: "CNNVD", id: "CNNVD-201609-632", }, ], }, sources_release_date: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", data: { "@container": "@list", }, }, data: [ { date: "2016-10-08T00:00:00", db: "CNVD", id: "CNVD-2016-08397", }, { date: "2016-10-05T00:00:00", db: "VULHUB", id: "VHN-95204", }, { date: "2016-10-05T00:00:00", db: "VULMON", id: "CVE-2016-6384", }, { date: "2016-09-28T00:00:00", db: "BID", id: "93209", }, { date: "2016-10-13T00:00:00", db: "JVNDB", id: "JVNDB-2016-005152", }, { date: "2016-10-05T17:59:02.727000", db: "NVD", id: "CVE-2016-6384", }, { date: "2016-09-29T00:00:00", db: "CNNVD", id: "CNNVD-201609-632", }, ], }, sources_update_date: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", data: { "@container": "@list", }, }, data: [ { date: "2016-10-08T00:00:00", db: "CNVD", id: "CNVD-2016-08397", }, { date: "2020-06-02T00:00:00", db: "VULHUB", id: "VHN-95204", }, { date: "2020-06-02T00:00:00", db: "VULMON", id: "CVE-2016-6384", }, { date: "2017-05-23T16:23:00", db: "BID", id: "93209", }, { date: "2016-10-13T00:00:00", db: "JVNDB", id: "JVNDB-2016-005152", }, { date: "2020-06-02T14:42:14.623000", db: "NVD", id: "CVE-2016-6384", }, { date: "2020-06-03T00:00:00", db: "CNNVD", id: "CNNVD-201609-632", }, ], }, threat_type: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "remote", sources: [ { db: "CNNVD", id: "CNNVD-201609-632", }, ], trust: 0.6, }, title: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "Cisco IOS and IOS XE Service disruption in (DoS) Vulnerabilities", sources: [ { db: "JVNDB", id: "JVNDB-2016-005152", }, ], trust: 0.8, }, type: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "input validation error", sources: [ { db: "CNNVD", id: "CNNVD-201609-632", }, ], trust: 0.6, }, }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
Title of the comment
Description of the comment
Loading…
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.