CVE-2013-3464: Buffer Overflow

Published Aug 12, 2013

Updated

Cisco IOS XR allows local users to cause a denial of service (Silicon Packet Processor memory corruption, improper mutex handling, and device reload) by starting an outbound flood of large ICMP Echo Request packets and stopping this with a CTRL-C sequence, aka Bug ID CSCui60347.

Affected Software

57 affected components

Cisco IOS XR=2.0\(.0\)

Cisco IOS XR=3.0\(.0\)

Cisco IOS XR=3.0\(.1\)

Cisco IOS XR=3.2\(.0\)

Cisco IOS XR=3.2\(.1\)

Cisco IOS XR=3.2\(.2\)

Cisco IOS XR=3.2\(.3\)

Cisco IOS XR=3.2\(.4\)

Cisco IOS XR=3.2\(.6\)

Cisco IOS XR=3.2\(.50\)

Cisco IOS XR=3.3\(.0\)

Cisco IOS XR=3.3\(.1\)

Cisco IOS XR=3.3\(.2\)

Cisco IOS XR=3.3\(.3\)

Cisco IOS XR=3.3\(.4\)

Cisco IOS XR=3.4\(.0\)

Cisco IOS XR=3.4\(.1\)

Cisco IOS XR=3.4\(.2\)

Cisco IOS XR=3.4\(.3\)

Cisco IOS XR=3.5\(.0\)

Cisco IOS XR=3.5\(.1\)

Cisco IOS XR=3.5\(.2\)

Cisco IOS XR=3.5\(.3\)

Cisco IOS XR=3.5\(.4\)

Cisco IOS XR=3.6\(.1\)

Cisco IOS XR=3.6\(.2\)

Cisco IOS XR=3.6\(.3\)

Cisco IOS XR=3.6_base

Cisco IOS XR=3.7\(.1\)

Cisco IOS XR=3.7\(.2\)

Cisco IOS XR=3.7\(.3\)

Cisco IOS XR=3.7_base

Cisco IOS XR=3.8\(.0\)

Cisco IOS XR=3.8\(.1\)

Cisco IOS XR=3.8\(.2\)

Cisco IOS XR=3.8\(.3\)

Cisco IOS XR=3.8\(.4\)

Cisco IOS XR=3.9\(.0\)

Cisco IOS XR=3.9\(.1\)

Cisco IOS XR=3.9\(.2\)

Cisco IOS XR=4.0\(.0\)

Cisco IOS XR=4.0\(.1\)

Cisco IOS XR=4.0\(.2\)

Cisco IOS XR=4.0\(.3\)

Cisco IOS XR=4.0\(.4\)

Cisco IOS XR=4.0\(.11\)

Cisco IOS XR=4.0_base

Cisco IOS XR=4.1\(.0\)

Cisco IOS XR=4.1\(.1\)

Cisco IOS XR=4.1\(.2\)

Cisco IOS XR=4.1_base

Cisco IOS XR=4.2\(.0\)

Cisco IOS XR=4.2\(.1\)

Cisco IOS XR=4.2\(.2\)

Cisco IOS XR=4.2\(.3\)

Cisco IOS XR=4.2\(.4\)

Cisco IOS XR=4.3\(.0\)

Event History

Aug 12, 2013

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2013-3464?

CVE-2013-3464 is categorized as a denial of service vulnerability with the potential to disrupt device operations.

How do I fix CVE-2013-3464?

To remediate CVE-2013-3464, ensure that your Cisco IOS XR software is updated to the latest version that patches this vulnerability.

Who is affected by CVE-2013-3464?

CVE-2013-3464 affects local users on Cisco IOS XR versions ranging from 2.0 to 4.3.

What types of attacks can CVE-2013-3464 facilitate?

CVE-2013-3464 can facilitate denial of service attacks through outboard flooding of large ICMP Echo Request packets.

Can CVE-2013-3464 cause permanent damage?

CVE-2013-3464 may lead to memory corruption and device reload, but it does not affect the permanent integrity of the device.