Vulnerabilities > CVE-2016-6382 - Resource Management Errors vulnerability in Cisco IOS and IOS XE

047910
CVSS 7.8 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
COMPLETE
network
low complexity
cisco
CWE-399
nessus

Summary

Cisco IOS 15.2 through 15.6 and IOS XE 3.6 through 3.17 and 16.1 allow remote attackers to cause a denial of service (device restart) via a malformed IPv6 Protocol Independent Multicast (PIM) register packet, aka Bug ID CSCuy16399.

Vulnerable Configurations

Part Description Count
OS
Cisco
169

Common Weakness Enumeration (CWE)

Nessus

  • NASL familyCISCO
    NASL idCISCO-SA-20160928-MSDP-IOSXE.NASL
    descriptionAccording to its self-reported version number and configuration, the remote Cisco IOS XE device is affected by multiple denial of service vulnerabilities : - A denial of service vulnerability exists due to improper validation of packets encapsulated in a PIM register message. An unauthenticated, remote attacker can exploit this, by sending an IPv6 PIM register packet to a PIM rendezvous point (RP), to cause the device to restart. (CVE-2016-6382) - A denial of service vulnerability exists in the IPv4 Multicast Source Discovery Protocol (MSDP) implementation due to improper validation of Source-Active (SA) messages received from a configured MSDP peer. An unauthenticated, remote attacker can exploit this to cause the device to restart. (CVE-2016-6392)
    last seen2020-06-01
    modified2020-06-02
    plugin id93898
    published2016-10-07
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/93898
    titleCisco IOS XE Multicast Routing Multiple DoS (cisco-sa-20160928-msdp)
  • NASL familyCISCO
    NASL idCISCO-SA-20160928-MSDP.NASL
    descriptionAccording to its self-reported version number and configuration, the remote Cisco IOS device is affected by multiple denial of service vulnerabilities : - A denial of service vulnerability exists due to improper validation of packets encapsulated in a PIM register message. An unauthenticated, remote attacker can exploit this, by sending an IPv6 PIM register packet to a PIM rendezvous point (RP), to cause the device to restart. (CVE-2016-6382) - A denial of service vulnerability exists in the IPv4 Multicast Source Discovery Protocol (MSDP) implementation due to improper validation of Source-Active (SA) messages received from a configured MSDP peer. An unauthenticated, remote attacker can exploit this to cause the device to restart. (CVE-2016-6392)
    last seen2020-06-01
    modified2020-06-02
    plugin id93899
    published2016-10-07
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/93899
    titleCisco IOS Multicast Routing Multiple DoS (cisco-sa-20160928-msdp)