CVE-2012-4617: Input Validation

Published Sep 27, 2012

Updated

The BGP implementation in Cisco IOS 15.2, IOS XE 3.5.xS before 3.5.2S, and IOS XR 4.1.0 through 4.2.2 allows remote attackers to cause a denial of service (multiple connection resets) by leveraging a peer relationship and sending a malformed attribute, aka Bug IDs CSCtt35379, CSCty58300, CSCtz63248, and CSCtz62914.

Affected Software

9 affected components

cisco IOS=15.2

Cisco IOS XE=3.5.0s

Cisco IOS XE=3.5.1s

cisco IOS XR=4.1

cisco IOS XR=4.1.1

cisco IOS XR=4.1.2

cisco IOS XR=4.2.0

cisco IOS XR=4.2.1

cisco IOS XR=4.2.2

Event History

Sep 27, 2012

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2012-4617?

CVE-2012-4617 has a severity rating of medium due to its ability to cause denial of service conditions.

How do I fix CVE-2012-4617?

To fix CVE-2012-4617, upgrade to the latest versions of Cisco IOS, IOS XE, or IOS XR as specified in the security advisory.

What systems are affected by CVE-2012-4617?

CVE-2012-4617 affects Cisco IOS 15.2, IOS XE 3.5.xS before 3.5.2S, as well as IOS XR versions 4.1.0 through 4.2.2.

Can CVE-2012-4617 be exploited remotely?

Yes, CVE-2012-4617 can be exploited remotely by attackers leveraging a peer relationship.

What type of attack does CVE-2012-4617 enable?

CVE-2012-4617 enables attackers to cause a denial of service through multiple connection resets.