CVE-2014-3327: Input Validation

Published Aug 11, 2014

Updated

The EnergyWise module in Cisco IOS 12.2, 15.0, 15.1, 15.2, and 15.4 and IOS XE 3.2.xXO, 3.3.xSG, 3.4.xSG, and 3.5.xE before 3.5.3E allows remote attackers to cause a denial of service (device reload) via a crafted IPv4 packet, aka Bug ID CSCup52101.

Affected Software

17 affected components

cisco IOS=12.2

cisco IOS=15.0

cisco IOS=15.1

cisco IOS=15.2

cisco IOS=15.4

Cisco IOS XE=3.2.00.xo.15.0\(2\)xo

Cisco IOS XE=3.2.0xo

Cisco IOS XE=3.3.0sg

Cisco IOS XE=3.3.1sg

Cisco IOS XE=3.4.0sg

Cisco IOS XE=3.4.1sg

Cisco IOS XE=3.4.2sg

Cisco IOS XE=3.4.3sg

Cisco IOS XE=3.4.4sg

Cisco IOS XE=3.5.0e

Cisco IOS XE=3.5.1e

Cisco IOS XE=3.5.2e

Event History

Aug 11, 2014

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-3327?

CVE-2014-3327 is rated as high severity due to its potential to cause denial of service through a device reload.

How do I fix CVE-2014-3327?

To mitigate CVE-2014-3327, you should upgrade to Cisco IOS versions 3.5.3E or later.

What systems are affected by CVE-2014-3327?

CVE-2014-3327 affects various Cisco IOS and IOS XE versions including 12.2, 15.0 through 15.4, and multiple 3.x revisions of IOS XE.

How does CVE-2014-3327 operate?

CVE-2014-3327 allows remote attackers to exploit the EnergyWise module by sending crafted IPv4 packets that cause device reloads.

Is there a workaround for CVE-2014-3327?

Currently, there is no documented workaround for CVE-2014-3327, therefore upgrading software is the recommended action.