CVE-2013-5472: Input Validation

Published Sep 27, 2013

Updated

The NTP implementation in Cisco IOS 12.0 through 12.4 and 15.0 through 15.1, and IOS XE 2.1 through 3.3, does not properly handle encapsulation of multicast NTP packets within MSDP SA messages, which allows remote attackers to cause a denial of service (device reload) by leveraging an MSDP peer relationship, aka Bug ID CSCuc81226.

Affected Software

47 affected components

Cisco IOS XE=2.1.0

Cisco IOS XE=2.1.1

Cisco IOS XE=2.1.2

Cisco IOS XE=2.2.1

Cisco IOS XE=2.2.2

Cisco IOS XE=2.2.3

Cisco IOS XE=2.3.0

Cisco IOS XE=2.3.1

Cisco IOS XE=2.3.1t

Cisco IOS XE=2.3.2

Cisco IOS XE=2.4.0

Cisco IOS XE=2.4.1

Cisco IOS XE=2.4.2

Cisco IOS XE=2.4.3

Cisco IOS XE=2.4.4

Cisco IOS XE=2.5.0

Cisco IOS XE=2.5.1

Cisco IOS XE=2.5.2

Cisco IOS XE=2.6.0

Cisco IOS XE=2.6.1

Cisco IOS XE=2.6.2

Cisco IOS XE=3.1.0s

Cisco IOS XE=3.1.0sg

Cisco IOS XE=3.1.1s

Cisco IOS XE=3.1.1sg

Cisco IOS XE=3.1.2s

Cisco IOS XE=3.1.3s

Cisco IOS XE=3.1.4s

Cisco IOS XE=3.2.00.xo.15.0\(2\)xo

Cisco IOS XE=3.2.0s

Cisco IOS XE=3.2.0sg

Cisco IOS XE=3.2.0xo

Cisco IOS XE=3.2.1s

Cisco IOS XE=3.2.1sg

Cisco IOS XE=3.2.2s

Cisco IOS XE=3.2.2sg

Cisco IOS XE=3.2.3sg

Cisco IOS XE=3.2.4sg

Cisco IOS XE=3.3.0s

Cisco IOS XE=3.3.0sg

cisco IOS=12.0

cisco IOS=12.1

cisco IOS=12.2

cisco IOS=12.3

cisco IOS=12.4

cisco IOS=15.0

cisco IOS=15.1

Event History

Sep 27, 2013

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2013-5472?

CVE-2013-5472 has a high severity rating due to its potential to cause a denial of service by reloading affected devices.

How do I fix CVE-2013-5472?

To mitigate CVE-2013-5472, upgrade the Cisco IOS or IOS XE to a version that addresses this vulnerability.

Which Cisco products are affected by CVE-2013-5472?

CVE-2013-5472 affects multiple versions of Cisco IOS from 12.0 through 15.1 and IOS XE from 2.1 to 3.3.

What impact does CVE-2013-5472 have on my network?

CVE-2013-5472 can lead to network downtime by causing devices to unexpectedly reload.

Can CVE-2013-5472 be exploited remotely?

Yes, CVE-2013-5472 can be exploited remotely by attackers using malicious multicast NTP packets.