Vulnerability Name:

CVE-2015-6273 (CCN-105915)

Assigned:2015-08-27
Published:2015-08-27
Updated:2017-09-20
Summary:Cisco IOS XE before 3.1.2S on ASR 1000 devices mishandles the automatic setup of Virtual Fragment Reassembly (VFR) by certain firewall and NAT components, which allows remote attackers to cause a denial of service (Embedded Services Processor crash) via crafted IP packets, aka Bug IDs CSCtf87624, CSCte93229, CSCtd19103, and CSCti63623.
CVSS v3 Severity:7.5 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
CVSS v2 Severity:7.8 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)
5.8 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Complete
7.8 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)
5.8 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Complete
Vulnerability Type:CWE-399
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2015-6273

Source: CCN
Type: Cisco Vulnerability Alert 40690
Cisco IOS XE VFR Feature Denial of Service Vulnerabilities

Source: CISCO
Type: Vendor Advisory
20150827 Cisco IOS XE VFR Feature Denial of Service Vulnerabilities

Source: SECTRACK
Type: UNKNOWN
1033408

Source: XF
Type: UNKNOWN
ciscoiosxe-cve20156273-dos(105915)

Vulnerable Configuration:Configuration 1:
  • cpe:/o:cisco:ios_xe:2.2.1:*:*:*:*:*:*:*
  • OR cpe:/o:cisco:ios_xe:2.2.2:*:*:*:*:*:*:*
  • OR cpe:/o:cisco:ios_xe:2.2.3:*:*:*:*:*:*:*
  • OR cpe:/o:cisco:ios_xe:3.1.0s:*:*:*:*:*:*:*
  • OR cpe:/o:cisco:ios_xe:3.1.1s:*:*:*:*:*:*:*
  • AND
  • cpe:/h:cisco:asr_1001:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:asr_1001-x:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:asr_1002:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:asr_1002-x:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:asr_1004:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:asr_1006:-:*:*:*:*:*:*:*
  • OR cpe:/h:cisco:asr_1013:-:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/o:cisco:ios_xe:2.2.1:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    cisco ios xe 2.2.1
    cisco ios xe 2.2.2
    cisco ios xe 2.2.3
    cisco ios xe 3.1.0s
    cisco ios xe 3.1.1s
    cisco asr 1001 -
    cisco asr 1001-x -
    cisco asr 1002 -
    cisco asr 1002-x -
    cisco asr 1004 -
    cisco asr 1006 -
    cisco asr 1013 -
    cisco ios xe 2.2.1