CVE-2008-1156: Infoleak

Published Mar 27, 2008

Updated

Unspecified vulnerability in the Multicast Virtual Private Network (MVPN) implementation in Cisco IOS 12.0, 12.2, 12.3, and 12.4 allows remote attackers to create "extra multicast states on the core routers" via a crafted Multicast Distribution Tree (MDT) Data Join message.

Affected Software

4 affected components

cisco Cisco IOS=12.3

cisco Cisco IOS=12.4

cisco IOS=12.2

cisco IOS=12.0

Remediation

Patch Available

http://www.cisco.com/warp/public/707/cisco-sa-20080326-mvpn.shtml

Event History

Mar 27, 2008

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2008-1156?

CVE-2008-1156 is classified as a High severity vulnerability due to its potential impact on network operations.

How do I fix CVE-2008-1156?

To fix CVE-2008-1156, upgrade to a fixed version of Cisco IOS that addresses the vulnerability.

What versions of Cisco IOS are affected by CVE-2008-1156?

CVE-2008-1156 affects Cisco IOS versions 12.0, 12.2, 12.3, and 12.4.

What type of attack is associated with CVE-2008-1156?

CVE-2008-1156 allows remote attackers to create extra multicast states on core routers using crafted MDT Data Join messages.

Is there a workaround for CVE-2008-1156?

There are no official workarounds for CVE-2008-1156; upgrading is the recommended mitigation.