CVE-2013-1165: Input Validation
Published Apr 11, 2013
·Updated
Cisco IOS XE 2.x and 3.x before 3.4.5S, and 3.5 through 3.7 before 3.7.1S, on 1000 series Aggregation Services Routers (ASR) allows remote attackers to cause a denial of service (card reload) by sending many crafted L2TP packets, aka Bug ID CSCtz23293.
Affected Software
38 affected components
Cisco IOS XE<=3.4.3s
Cisco IOS XE=2.1.0
Cisco IOS XE=2.1.1
Cisco IOS XE=2.1.2
Cisco IOS XE=2.2.1
Cisco IOS XE=2.2.2
Cisco IOS XE=2.2.3
Cisco IOS XE=2.3.0
Cisco IOS XE=2.3.1
Cisco IOS XE=2.3.1t
Cisco IOS XE=2.3.2
Cisco IOS XE=2.4.0
Cisco IOS XE=2.4.1
Cisco IOS XE=2.4.2
Cisco IOS XE=2.4.3
Cisco IOS XE=2.4.4
Cisco IOS XE=2.5.0
Cisco IOS XE=2.5.1
Cisco IOS XE=2.5.2
Cisco IOS XE=2.6.0
Cisco IOS XE=2.6.1
Cisco IOS XE=2.6.2
Cisco IOS XE=3.1.0s
Cisco IOS XE=3.1.1s
Cisco IOS XE=3.1.2s
Cisco IOS XE=3.1.3s
Cisco IOS XE=3.1.4s
Cisco IOS XE=3.4.0as
Cisco IOS XE=3.4.0s
Cisco IOS XE=3.4.2s
Cisco IOS XE=3.7.0s
Cisco Asr 1001
Cisco Asr 1002
Cisco Asr 1002-x
Cisco Asr 1002 Fixed Router
Cisco Asr 1004
Cisco Asr 1006
Cisco Asr 1023 Router
Event History
Apr 11, 2013
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2013-1165?
CVE-2013-1165 is categorized as a medium severity vulnerability that may lead to denial of service.
2
How do I fix CVE-2013-1165?
To fix CVE-2013-1165, upgrade affected Cisco IOS XE versions to 3.4.5S or later.
3
Which Cisco products are affected by CVE-2013-1165?
CVE-2013-1165 affects Cisco IOS XE versions 2.x and 3.x running on ASR 1000 series routers.
4
Can CVE-2013-1165 be exploited remotely?
Yes, CVE-2013-1165 can be exploited remotely by sending crafted L2TP packets.
5
What are the potential impacts of CVE-2013-1165?
Exploitation of CVE-2013-1165 can lead to a card reload and service disruption for impacted Cisco devices.