CVE-2013-5546: Input Validation
Published Oct 31, 2013
·Updated
The TCP reassembly feature in Cisco IOS XE 3.7 before 3.7.3S and 3.8 before 3.8.1S on 1000 ASR devices allows remote attackers to cause a denial of service (device reload) via large TCP packets that are processed by the (1) NAT or (2) ALG component, aka Bug ID CSCud72509.
Affected Software
10 affected components
Cisco IOS XE=3.7.0s
Cisco IOS XE=3.7.1s
Cisco IOS XE=3.7.2s
Cisco IOS XE=3.8.0s
Cisco Asr 1001
Cisco Asr 1002
Cisco Asr 1002-x
Cisco Asr 1004
Cisco Asr 1006
Cisco Asr 1023 Router
Event History
Oct 31, 2013
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2013-5546?
CVE-2013-5546 has a severity rating of High due to the potential for remote denial of service attacks.
2
How do I fix CVE-2013-5546?
To fix CVE-2013-5546, upgrade your Cisco IOS XE software to version 3.7.3S or later, or 3.8.1S or later.
3
Who is affected by CVE-2013-5546?
CVE-2013-5546 affects Cisco ASR 1000 series devices running versions 3.7.0S through 3.8.0S.
4
What type of attack does CVE-2013-5546 allow?
CVE-2013-5546 allows attackers to cause a denial of service by sending large TCP packets that overwhelm the device.
5
When was CVE-2013-5546 disclosed?
CVE-2013-5546 was disclosed on October 30, 2013.