CVE-2000-0380: Input Validation

Published Apr 26, 2000

Updated

The IOS HTTP service in Cisco routers and switches running IOS 11.1 through 12.1 allows remote attackers to cause a denial of service by requesting a URL that contains a %% string.

Affected Software

39 affected components

Cisco IOS=11.1

Cisco IOS=11.2

Cisco IOS=11.2\(4\)f1

Cisco IOS=11.2\(8\)

Cisco IOS=11.2\(8\)p

Cisco IOS=11.2\(9\)p

Cisco IOS=11.2\(9\)xa

Cisco IOS=11.2\(10\)

Cisco IOS=11.2\(10\)bc

Cisco IOS=11.2\(17\)

Cisco IOS=11.2p

Cisco IOS=11.3

Cisco IOS=11.3\(1\)

Cisco IOS=11.3\(1\)ed

Cisco IOS=11.3\(1\)t

Cisco IOS=11.3t

Cisco IOS=12.0

Cisco IOS=12.0\(1\)w

Cisco IOS=12.0\(1\)xa3

Cisco IOS=12.0\(1\)xb

Cisco IOS=12.0\(1\)xe

Cisco IOS=12.0\(2\)

Cisco IOS=12.0\(2\)xc

Cisco IOS=12.0\(2\)xd

Cisco IOS=12.0\(2\)xf

Cisco IOS=12.0\(2\)xg

Cisco IOS=12.0\(3\)t2

Cisco IOS=12.0\(4\)

Cisco IOS=12.0\(4\)s

Cisco IOS=12.0\(4\)t

Cisco IOS=12.0\(5\)

Cisco IOS=12.0\(5\)t1

Cisco IOS=12.0\(6\)

Cisco IOS=12.0\(7\)t

Cisco IOS=12.0\(8\)

Cisco IOS=12.0\(9\)s

Cisco IOS=12.0db

Cisco IOS=12.0s

Cisco IOS=12.0t

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Configuration
Disable the IOS HTTP service on affected routers and switches if it is not required.
Cisco IOS HTTP service http server = disabled
Compensating control
Restrict network access to the device HTTP service to trusted management hosts or networks (for example via ACLs, firewall rules, or management plane isolation) until a vendor fix is available.

Event History

Apr 26, 2000

CVE Published

04:00 AM

Data Sourced

via NVD·04:00 AM

DescriptionSeverityWeaknessAffected Software

Jul 12, 2000

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2000-0380?

CVE-2000-0380 is classified as a denial of service vulnerability affecting Cisco IOS devices.

How do I fix CVE-2000-0380?

To mitigate CVE-2000-0380, it is recommended to upgrade the software to a non-vulnerable version of Cisco IOS.

What versions of Cisco IOS are affected by CVE-2000-0380?

CVE-2000-0380 affects Cisco IOS versions 11.1 through 12.1.

Can CVE-2000-0380 be exploited remotely?

Yes, CVE-2000-0380 can be exploited remotely by sending a specially crafted URL containing a %% string.

What are the potential impacts of CVE-2000-0380?

Exploitation of CVE-2000-0380 may lead to a denial of service condition, causing the affected Cisco devices to become unresponsive.