Vulnerabilities > CVE-2010-0577 - Resource Management Errors vulnerability in Cisco IOS

CVSS 7.1 - HIGH

Attack vector

NETWORK

Attack complexity

MEDIUM

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

COMPLETE

network

cisco

CWE-399

nessus

NVD

Published: 2010-03-25

Updated: 2017-08-17

Summary

Cisco IOS 12.2 through 12.4, when certain PMTUD, SNAT, or window-size configurations are used, allows remote attackers to cause a denial of service (infinite loop, and device reload or hang) via a TCP segment with crafted options, aka Bug ID CSCsz75186.

Vulnerable Configurations

Part	Description	Count
OS	Cisco Cisco IOS 12.2B Cisco IOS 12.2Bc Cisco IOS 12.2Bx Cisco IOS 12.2By Cisco IOS 12.2Bz Cisco IOS 12.2Cx Cisco IOS 12.2Cy Cisco IOS 12.2Cz Cisco IOS 12.2Jx Cisco IOS 12.2Mc Cisco IOS 12.2T Cisco IOS 12.2Tpc Cisco IOS 12.2Xj Cisco IOS 12.2Xk Cisco IOS 12.2Xl Cisco IOS 12.2Xm Cisco IOS 12.2Xr Cisco IOS 12.2Xw Cisco IOS 12.2Ya Cisco IOS 12.2Yb Cisco IOS 12.2Yd Cisco IOS 12.2Yf Cisco IOS 12.2Yg Cisco IOS 12.2Yh Cisco IOS 12.2Yj Cisco IOS 12.2Yl Cisco IOS 12.2Ym Cisco IOS 12.2Yn Cisco IOS 12.2Yp Cisco IOS 12.2Yq Cisco IOS 12.2Yr Cisco IOS 12.2Yt Cisco IOS 12.2Yu Cisco IOS 12.2Yv Cisco IOS 12.2Yw Cisco IOS 12.2Yy Cisco IOS 12.2Zb Cisco IOS 12.2Zc Cisco IOS 12.2Zd Cisco IOS 12.2Ze Cisco IOS 12.2Zf Cisco IOS 12.2Zg Cisco IOS 12.2Zh Cisco IOS 12.2Zj Cisco IOS 12.2Zl Cisco IOS 12.2Zp Cisco IOS 12.3 Cisco IOS 12.3B Cisco IOS 12.3Bc Cisco IOS 12.3Bw Cisco IOS 12.3Ja Cisco IOS 12.3Jea Cisco IOS 12.3Jeb Cisco IOS 12.3Jec Cisco IOS 12.3Jed Cisco IOS 12.3Jk Cisco IOS 12.3Jl Cisco IOS 12.3Jx Cisco IOS 12.3T Cisco IOS 12.3Tpc Cisco IOS 12.3Xa Cisco IOS 12.3Xb Cisco IOS 12.3Xc Cisco IOS 12.3Xd Cisco IOS 12.3Xe Cisco IOS 12.3Xf Cisco IOS 12.3Xg Cisco IOS 12.3Xi Cisco IOS 12.3Xj Cisco IOS 12.3Xk Cisco IOS 12.3Xl Cisco IOS 12.3Xq Cisco IOS 12.3Xr Cisco IOS 12.3Xs Cisco IOS 12.3Xu Cisco IOS 12.3Xw Cisco IOS 12.3Xx Cisco IOS 12.3Xy Cisco IOS 12.3Xz Cisco IOS 12.3Ya Cisco IOS 12.3Yd Cisco IOS 12.3Yf Cisco IOS 12.3Yg Cisco IOS 12.3Yh Cisco IOS 12.3Yi Cisco IOS 12.3Yj Cisco IOS 12.3Yk Cisco IOS 12.3Ym Cisco IOS 12.3Yq Cisco IOS 12.3Ys Cisco IOS 12.3Yt Cisco IOS 12.3Yu Cisco IOS 12.3Yx Cisco IOS 12.3Yz Cisco IOS 12.3Za Cisco IOS 12.4 Cisco IOS 12.4Gc Cisco IOS 12.4Ja Cisco IOS 12.4Jda Cisco IOS 12.4Jdc Cisco IOS 12.4Jdd Cisco IOS 12.4Jk Cisco IOS 12.4Jl Cisco IOS 12.4Jma Cisco IOS 12.4Jmb Cisco IOS 12.4Jx Cisco IOS 12.4Md Cisco IOS 12.4Mda Cisco IOS 12.4Mr Cisco IOS 12.4Sw Cisco IOS 12.4T Cisco IOS 12.4Xa Cisco IOS 12.4Xb Cisco IOS 12.4Xc Cisco IOS 12.4Xd Cisco IOS 12.4Xe Cisco IOS 12.4Xf Cisco IOS 12.4Xg Cisco IOS 12.4Xj Cisco IOS 12.4Xk Cisco IOS 12.4Xl Cisco IOS 12.4Xm Cisco IOS 12.4Xn Cisco IOS 12.4Xp Cisco IOS 12.4Xq Cisco IOS 12.4Xr Cisco IOS 12.4Xt Cisco IOS 12.4Xv Cisco IOS 12.4Xw Cisco IOS 12.4Xy Cisco IOS 12.4Xz Cisco IOS 12.4Ya Cisco IOS 12.4Yb Cisco IOS 12.4Yd Cisco IOS 12.4Ye Cisco IOS 12.4Yg	136

Common Weakness Enumeration (CWE)

CWE-399 - Resource Management Errors

Nessus

NASL family	CISCO
NASL id	CISCO-SA-20100324-TCPHTTP.NASL
description	Cisco IOS Software is affected by a denial of service vulnerability that may allow a remote unauthenticated attacker to cause an affected device to reload or hang. The vulnerability may be triggered by a TCP segment containing crafted TCP options that is received during the TCP session establishment phase. In addition to specific, crafted TCP options, the device must have a special configuration to be affected by this vulnerability. Cisco has released free software updates that address this vulnerability.
last seen	2019-10-28
modified	2010-09-01
plugin id	49055
published	2010-09-01
reporter	This script is Copyright (C) 2010-2018 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/49055
title	Cisco IOS Software Crafted TCP Packet Denial of Service Vulnerability (cisco-sa-20100324-tcp)

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Nessus

References