CVE-2014-3354: Input Validation

Published Sep 25, 2014

Updated

Cisco IOS 12.0, 12.2, 12.4, 15.0, 15.1, 15.2, and 15.3 and IOS XE 2.x and 3.x before 3.7.4S; 3.2.xSE and 3.3.xSE before 3.3.2SE; 3.3.xSG and 3.4.xSG before 3.4.4SG; and 3.8.xS, 3.9.xS, and 3.10.xS before 3.10.1S allow remote attackers to cause a denial of service (device reload) via malformed RSVP packets, aka Bug ID CSCui11547.

Affected Software

131 affected components

cisco IOS=12.0

cisco IOS=12.2

cisco IOS=12.4

cisco IOS=15.0

cisco IOS=15.1

cisco IOS=15.2

cisco IOS=15.3

Cisco IOS XE=2.1

Cisco IOS XE=2.1.0

Cisco IOS XE=2.1.1

Cisco IOS XE=2.1.2

Cisco IOS XE=2.2

Cisco IOS XE=2.2.1

Cisco IOS XE=2.2.2

Cisco IOS XE=2.2.3

Cisco IOS XE=2.3

Cisco IOS XE=2.3.0

Cisco IOS XE=2.3.1

Cisco IOS XE=2.3.1t

Cisco IOS XE=2.3.2

Cisco IOS XE=2.4

Cisco IOS XE=2.4.0

Cisco IOS XE=2.4.1

Cisco IOS XE=2.4.2

Cisco IOS XE=2.4.3

Cisco IOS XE=2.4.4

Cisco IOS XE=2.5\(.0\)

Cisco IOS XE=2.5.0

Cisco IOS XE=2.5.1

Cisco IOS XE=2.5.2

Cisco IOS XE=2.6\(.0\)

Cisco IOS XE=2.6\(.1\)

Cisco IOS XE=2.6\(.2\)

Cisco IOS XE=2.6.0

Cisco IOS XE=2.6.1

Cisco IOS XE=2.6.2

Cisco IOS XE=3.1.0s

Cisco IOS XE=3.1.0sg

Cisco IOS XE=3.1.1s

Cisco IOS XE=3.1.1sg

Cisco IOS XE=3.1.2s

Cisco IOS XE=3.1.3s

Cisco IOS XE=3.1.4s

Cisco IOS XE=3.1s\(.0\)

Cisco IOS XE=3.1s\(.1\)

Cisco IOS XE=3.1s\(.2\)

Cisco IOS XE=3.1s\(.3\)

Cisco IOS XE=3.2.00.xo.15.0\(2\)xo

Cisco IOS XE=3.2.0s

Cisco IOS XE=3.2.0sg

Cisco IOS XE=3.2.0xo

Cisco IOS XE=3.2.1s

Cisco IOS XE=3.2.1se

Cisco IOS XE=3.2.1sg

Cisco IOS XE=3.2.2s

Cisco IOS XE=3.2.2se

Cisco IOS XE=3.2.2sg

Cisco IOS XE=3.2.3se

Cisco IOS XE=3.2.3sg

Cisco IOS XE=3.2.4sg

Cisco IOS XE=3.2s\(.0\)

Cisco IOS XE=3.2s\(.1\)

Cisco IOS XE=3.2s\(.2\)

Cisco IOS XE=3.3.0s

Cisco IOS XE=3.3.0se

Cisco IOS XE=3.3.0sg

Cisco IOS XE=3.3.1s

Cisco IOS XE=3.3.1se

Cisco IOS XE=3.3.1sg

Cisco IOS XE=3.3.2s

Cisco IOS XE=3.3.3s

Cisco IOS XE=3.3s\(.0\)

Cisco IOS XE=3.3s\(.1\)

Cisco IOS XE=3.3s\(.2\)

Cisco IOS XE=3.4.0as

Cisco IOS XE=3.4.0s

Cisco IOS XE=3.4.0sg

Cisco IOS XE=3.4.1s

Cisco IOS XE=3.4.1sg

Cisco IOS XE=3.4.2s

Cisco IOS XE=3.4.2sg

Cisco IOS XE=3.4.3s

Cisco IOS XE=3.4.3sg

Cisco IOS XE=3.4.4s

Cisco IOS XE=3.4.5s

Cisco IOS XE=3.4.xs

Cisco IOS XE=3.4s\(.0\)

Cisco IOS XE=3.4s\(.1\)

Cisco IOS XE=3.4s\(.2\)

Cisco IOS XE=3.4s\(.3\)

Cisco IOS XE=3.4s\(.4\)

Cisco IOS XE=3.4s\(.5\)

Cisco IOS XE=3.4s\(.6\)

Cisco IOS XE=3.5.0e

Cisco IOS XE=3.5.0s

Cisco IOS XE=3.5.1e

Cisco IOS XE=3.5.1s

Cisco IOS XE=3.5.2e

Cisco IOS XE=3.5.2s

Cisco IOS XE=3.5.xs

Cisco IOS XE=3.5e

Cisco IOS XE=3.5s\(.0\)

Cisco IOS XE=3.5s\(.1\)

Cisco IOS XE=3.5s\(.2\)

Cisco IOS XE=3.6.0s

Cisco IOS XE=3.6.1s

Cisco IOS XE=3.6.2s

Cisco IOS XE=3.6s\(.0\)

Cisco IOS XE=3.6s\(.1\)

Cisco IOS XE=3.6s\(.2\)

Cisco IOS XE=3.7.0s

Cisco IOS XE=3.7.1s

Cisco IOS XE=3.7.2s

Cisco IOS XE=3.7s\(.0\)

Cisco IOS XE=3.7s\(.1\)

Cisco IOS XE=3.7s\(.2\)

Cisco IOS XE=3.7s\(.3\)

Cisco IOS XE=3.8.0s

Cisco IOS XE=3.8s\(.0\)

Cisco IOS XE=3.8s\(.1\)

Cisco IOS XE=3.8s\(.2\)

Cisco IOS XE=3.9s\(.0\)

Cisco IOS XE=3.9s\(.1\)

Cisco IOS XE=3.9s\(.2\)

Cisco IOS XE=3.10

Cisco IOS XE=3.10.0s

Cisco IOS XE=3.10.1s

Cisco IOS XE=3.10.1s1

Cisco IOS XE=3.10.2s

Cisco IOS XE=3.10s\(.0\)

Cisco IOS XE=3.12s

Event History

Sep 25, 2014

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2014-3354?

CVE-2014-3354 is classified as a high severity vulnerability due to its potential to cause denial of service.

How do I fix CVE-2014-3354?

Fixing CVE-2014-3354 involves updating affected Cisco IOS and IOS XE software to a version that includes the security patches.

What are the affected versions in CVE-2014-3354?

CVE-2014-3354 affects Cisco IOS versions 12.0, 12.2, 12.4, 15.0, 15.1, 15.2, 15.3, and several versions of IOS XE.

What is the impact of CVE-2014-3354?

The impact of CVE-2014-3354 is that remote attackers can exploit it to reload the affected Cisco devices, causing a denial of service.

Are there any workarounds for CVE-2014-3354?

Workarounds for CVE-2014-3354 may include disabling RSVP on affected devices, but applying patches is the recommended mitigation.