| Vulnerability Name: | CVE-2013-3436 (CCN-85868) | ||||||||
| Assigned: | 2013-07-18 | ||||||||
| Published: | 2013-07-18 | ||||||||
| Updated: | 2017-11-29 | ||||||||
| Summary: | The default configuration of the Group Encrypted Transport VPN (GET VPN) feature on Cisco IOS uses an improper mechanism for enabling Group Domain of Interpretation (GDOI) traffic flow, which allows remote attackers to bypass the encryption policy via certain uses of UDP port 848, aka Bug ID CSCui07698. | ||||||||
| CVSS v3 Severity: | 5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
| ||||||||
| CVSS v2 Severity: | 5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N) 3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-264 | ||||||||
| Vulnerability Consequences: | Bypass Security | ||||||||
| References: | Source: MITRE Type: CNA CVE-2013-3436 Source: OSVDB Type: UNKNOWN 95460 Source: CCN Type: SA54111 Cisco IOS GET VPN Information Disclosure Weakness Source: CCN Type: Cisco Security Notice Cisco IOS GET VPN Encryption Policy Bypass Vulnerability Source: CISCO Type: Vendor Advisory 20130718 Cisco IOS GET VPN Encryption Policy Bypass Vulnerability Source: CONFIRM Type: Vendor Advisory http://tools.cisco.com/security/center/viewAlert.x?alertId=30140 Source: BID Type: UNKNOWN 61362 Source: CCN Type: BID-61362 Cisco IOS GET VPN Encryption Policy CVE-2013-3436 Security Bypass Vulnerability Source: SECTRACK Type: UNKNOWN 1028810 Source: XF Type: UNKNOWN ciscoios-cve20133436-sec-bypass(85868) Source: XF Type: UNKNOWN ciscoios-cve20133436-sec-bypass(85868) | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| BACK | |||||||||