Vulnerabilities > CVE-2009-2049 - Configuration vulnerability in Cisco IOS and IOS XE

047910
CVSS 0.0 - NONE
Attack vector
UNKNOWN
Attack complexity
UNKNOWN
Privileges required
UNKNOWN
Confidentiality impact
UNKNOWN
Integrity impact
UNKNOWN
Availability impact
UNKNOWN
cisco
CWE-16
nessus
NVD
Published: 2009-07-30
Updated: 2017-09-29

Summary

Cisco IOS 12.0(32)S12 through 12.0(32)S13 and 12.0(33)S3 through 12.0(33)S4, 12.0(32)SY8 through 12.0(32)SY9, 12.2(33)SXI1 through 12.2(33)SXI2, 12.2XNC before 12.2(33)XNC2, 12.2XND before 12.2(33)XND1, and 12.4(24)T1; and IOS XE 2.3 through 2.3.1t and 2.4 through 2.4.0; when RFC4893 BGP routing is enabled, allows remote attackers to cause a denial of service (device reload) by using an RFC4271 peer to send a malformed update, aka Bug ID CSCta33973.

Vulnerable Configurations

Part Description Count
OS
Cisco
15

Common Weakness Enumeration (CWE)

Nessus

NASL familyCISCO
NASL idCISCO-SA-20090729-BGPHTTP.NASL
descriptionRecent versions of Cisco IOS Software support RFC4893 (
last seen2019-10-28
modified2010-09-01
plugin id49037
published2010-09-01
reporterThis script is (C) 2010-2018 Tenable Network Security, Inc.
sourcehttps://www.tenable.com/plugins/nessus/49037
titleCisco IOS Software Border Gateway Protocol 4-Byte Autonomous System Number Vulnerabilities - Cisco Systems

Oval

accepted2013-04-22T04:00:15.427-04:00
classvulnerability
contributors
  • nameKASHIF LATIF
    organizationDTCC
  • nameShane Shaffer
    organizationG2, Inc.
descriptionCisco IOS 12.0(32)S12 through 12.0(32)S13 and 12.0(33)S3 through 12.0(33)S4, 12.0(32)SY8 through 12.0(32)SY9, 12.2(33)SXI1 through 12.2(33)SXI2, 12.2XNC before 12.2(33)XNC2, 12.2XND before 12.2(33)XND1, and 12.4(24)T1; and IOS XE 2.3 through 2.3.1t and 2.4 through 2.4.0; when RFC4893 BGP routing is enabled, allows remote attackers to cause a denial of service (device reload) by using an RFC4271 peer to send a malformed update, aka Bug ID CSCta33973.
familyios
idoval:org.mitre.oval:def:6853
statusaccepted
submitted2010-05-12T12:00:00.000-04:00
titleCisco IOS Software BGP Routing Dos Vulnerability
version9

Seebug

bulletinFamilyexploit
descriptionBugraq ID: 35860 CVE ID：CVE-2009-2049 Cisco IOS是一款流行的Internet操作系统。 Cisco IOS处理边界网关协议存在拒绝服务攻击，远程攻击者可以利用漏洞使设备重启。 当受影响设备处理畸形BGP更新时可使设备重载。 成功利用此漏洞需要3个条件： -受影响的Cisco IOS软件设备为4字节AS自治号BGP Speaker -BGP对等邻居为2字节AS自治号BGP Speaker -BGP对等邻居能发送特殊构建的非RFC适应的BGP更新消息 此漏洞Cisco Bug ID为CSCta33973，CVEID为CVE-2009-2049。 Cisco IOS XE 2.4 Cisco IOS XE 2.3.1 t Cisco IOS XE 2.3.1 Cisco IOS 12.4T Cisco IOS 12.4T Cisco IOS 12.2SXI Cisco IOS 12.2 XND Cisco IOS 12.2 XNC Cisco IOS 12.0SY Cisco IOS 12.0S Cisco IOS 12.0(33)S3 Cisco IOS 12.0(32)SY8 Cisco IOS 12.0(32)S12 厂商解决方案 用户可参考如下安全公告获得补丁信息： http://www.cisco.com/warp/public/707/cisco-sa-20090729-bgp.shtml#@ID
idSSV:11939
last seen2017-11-19
modified2009-07-30
published2009-07-30
reporterRoot
titleCisco IOS畸形边界网关协议更新拒绝服务漏洞

References