CVE-2013-5475: Input Validation

Published Sep 27, 2013

Updated

Cisco IOS 12.2 through 12.4 and 15.0 through 15.3, and IOS XE 2.1 through 3.9, allows remote attackers to cause a denial of service (device reload) via crafted DHCP packets that are processed locally by a (1) server or (2) relay agent, aka Bug ID CSCug31561.

Affected Software

68 affected components

Cisco IOS XE=2.1.0

Cisco IOS XE=2.1.1

Cisco IOS XE=2.1.2

Cisco IOS XE=2.2.1

Cisco IOS XE=2.2.2

Cisco IOS XE=2.2.3

Cisco IOS XE=2.3.0

Cisco IOS XE=2.3.1

Cisco IOS XE=2.3.1t

Cisco IOS XE=2.3.2

Cisco IOS XE=2.4.0

Cisco IOS XE=2.4.1

Cisco IOS XE=2.4.2

Cisco IOS XE=2.4.3

Cisco IOS XE=2.4.4

Cisco IOS XE=2.5.0

Cisco IOS XE=2.5.1

Cisco IOS XE=2.5.2

Cisco IOS XE=2.6.0

Cisco IOS XE=2.6.1

Cisco IOS XE=2.6.2

Cisco IOS XE=3.1.0s

Cisco IOS XE=3.1.0sg

Cisco IOS XE=3.1.1s

Cisco IOS XE=3.1.1sg

Cisco IOS XE=3.1.2s

Cisco IOS XE=3.1.3s

Cisco IOS XE=3.1.4s

Cisco IOS XE=3.2.00.xo.15.0\(2\)xo

Cisco IOS XE=3.2.0s

Cisco IOS XE=3.2.0sg

Cisco IOS XE=3.2.0xo

Cisco IOS XE=3.2.1s

Cisco IOS XE=3.2.1sg

Cisco IOS XE=3.2.2s

Cisco IOS XE=3.2.2sg

Cisco IOS XE=3.2.3sg

Cisco IOS XE=3.2.4sg

Cisco IOS XE=3.3.0s

Cisco IOS XE=3.3.0sg

Cisco IOS XE=3.3.1s

Cisco IOS XE=3.3.1sg

Cisco IOS XE=3.3.2s

Cisco IOS XE=3.3.3s

Cisco IOS XE=3.4.0as

Cisco IOS XE=3.4.0s

Cisco IOS XE=3.4.1s

Cisco IOS XE=3.4.2s

Cisco IOS XE=3.4.3s

Cisco IOS XE=3.4.4s

Cisco IOS XE=3.4.5s

Cisco IOS XE=3.4.xs

Cisco IOS XE=3.5.0s

Cisco IOS XE=3.5.1s

Cisco IOS XE=3.5.2s

Cisco IOS XE=3.5.xs

Cisco IOS XE=3.6.0s

Cisco IOS XE=3.6.1s

Cisco IOS XE=3.6.2s

Cisco IOS XE=3.7.0s

Cisco IOS XE=3.7.1s

cisco IOS=12.2

cisco IOS=12.3

cisco IOS=12.4

cisco IOS=15.0

cisco IOS=15.1

cisco IOS=15.2

cisco IOS=15.3

Event History

Sep 27, 2013

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2013-5475?

CVE-2013-5475 has a severity rating that indicates a potential denial of service, leading to device reload.

How do I fix CVE-2013-5475?

To address CVE-2013-5475, update your Cisco IOS or IOS XE to a version that includes the patch for this vulnerability.

Which Cisco products are affected by CVE-2013-5475?

CVE-2013-5475 affects Cisco IOS versions 12.2 to 12.4 and 15.0 to 15.3, as well as certain versions of IOS XE.

What kind of attack does CVE-2013-5475 pose?

CVE-2013-5475 allows remote attackers to launch a denial of service attack by sending crafted DHCP packets.

Is there a workaround for CVE-2013-5475?

While the best solution is to install the latest updates, implementing access controls to limit DHCP traffic may help mitigate the effects of CVE-2013-5475.