CVE-2013-1148: Buffer Overflow

Published Mar 28, 2013

Updated

The General Responder implementation in the IP Service Level Agreement (SLA) feature in Cisco IOS 15.2 and IOS XE 3.1.xS through 3.4.xS before 3.4.5S and 3.5.xS through 3.7.xS before 3.7.2S allows remote attackers to cause a denial of service (device reload) via crafted (1) IPv4 or (2) IPv6 IP SLA packets on UDP port 1167, aka Bug ID CSCuc72594.

Affected Software

20 affected components

cisco IOS=15.2

Cisco IOS XE=3.1.0s

Cisco IOS XE=3.1.1s

Cisco IOS XE=3.1.2s

Cisco IOS XE=3.1.3s

Cisco IOS XE=3.1.4s

Cisco IOS XE=3.2.0s

Cisco IOS XE=3.2.1s

Cisco IOS XE=3.2.2s

Cisco IOS XE=3.3.0s

Cisco IOS XE=3.3.1s

Cisco IOS XE=3.3.2s

Cisco IOS XE=3.3.3s

Cisco IOS XE=3.4.0s

Cisco IOS XE=3.4.1s

Cisco IOS XE=3.4.2s

Cisco IOS XE=3.4.3s

Cisco IOS XE=3.5.0s

Cisco IOS XE=3.5.1s

Cisco IOS XE=3.5.2s

Event History

Mar 28, 2013

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2013-1148?

CVE-2013-1148 has a Medium severity rating due to its potential to cause a denial of service.

How do I fix CVE-2013-1148?

To address CVE-2013-1148, upgrade your Cisco IOS or IOS XE software to the versions that are not affected, as detailed in the advisory.

What systems are affected by CVE-2013-1148?

CVE-2013-1148 affects various versions of Cisco IOS 15.2 and IOS XE 3.1.xS through 3.7.xS prior to specific remedial releases.

Are there any workarounds for CVE-2013-1148?

There are no specific workarounds for CVE-2013-1148; upgrading to a patched version is recommended.

What vulnerability type is CVE-2013-1148 classified as?

CVE-2013-1148 is classified as a denial of service vulnerability affecting the IP Service Level Agreement feature.