CVE-2014-3378: Input Validation
Published Sep 20, 2014
·Updated
tacacsd in Cisco IOS XR 5.1 and earlier allows remote attackers to cause a denial of service (process reload) via a malformed TACACS+ packet, aka Bug ID CSCum00468.
Affected Software
55 affected components
Cisco IOS XR=2.0
Cisco IOS XR=3.0
Cisco IOS XR=3.0.1
Cisco IOS XR=3.1
Cisco IOS XR=3.1.0
Cisco IOS XR=3.2
Cisco IOS XR=3.2.1
Cisco IOS XR=3.2.2
Cisco IOS XR=3.2.4
Cisco IOS XR=3.2.50
Cisco IOS XR=3.3
Cisco IOS XR=3.3.1
Cisco IOS XR=3.3.2
Cisco IOS XR=3.3.3
Cisco IOS XR=3.3.4
Cisco IOS XR=3.3.5
Cisco IOS XR=3.4
Cisco IOS XR=3.4.1
Cisco IOS XR=3.4.2
Cisco IOS XR=3.4.3
Cisco IOS XR=3.5
Cisco IOS XR=3.5.1
Cisco IOS XR=3.5.2
Cisco IOS XR=3.5.3
Cisco IOS XR=3.5.4
Cisco IOS XR=3.6
Cisco IOS XR=3.6.1
Cisco IOS XR=3.6.2
Cisco IOS XR=3.6.3
Cisco IOS XR=3.7
Cisco IOS XR=3.7.1
Cisco IOS XR=3.7.2
Cisco IOS XR=3.7.3
Cisco IOS XR=3.8.0
Cisco IOS XR=3.8.1
Cisco IOS XR=3.8.2
Cisco IOS XR=3.8.3
Cisco IOS XR=3.8.4
Cisco IOS XR=3.9.0
Cisco IOS XR=3.9.1
Cisco IOS XR=3.9.2
Cisco IOS XR=4.0.0
Cisco IOS XR=4.0.1
Cisco IOS XR=4.0.2
Cisco IOS XR=4.0.3
Cisco IOS XR=4.0.4
Cisco IOS XR=4.1
Cisco IOS XR=4.1.1
Cisco IOS XR=4.1.2
Cisco IOS XR=4.2.0
Cisco IOS XR=4.3.0
Cisco IOS XR=4.3.1
Cisco IOS XR=4.3.2
Cisco IOS XR=4.3.4
Cisco IOS XR=5.1.0
Event History
Sep 20, 2014
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-3378?
CVE-2014-3378 has a severity rating of 'High' due to its potential to cause a denial of service.
2
How do I fix CVE-2014-3378?
To fix CVE-2014-3378, you should upgrade to a patched version of Cisco IOS XR that addresses this vulnerability.
3
Who is affected by CVE-2014-3378?
CVE-2014-3378 affects devices running vulnerable versions of Cisco IOS XR, specifically versions 5.1 and earlier.
4
What type of vulnerability is CVE-2014-3378?
CVE-2014-3378 is a denial of service vulnerability caused by processing malformed TACACS+ packets.
5
Can CVE-2014-3378 be exploited remotely?
Yes, CVE-2014-3378 can be exploited remotely by attackers sending specially crafted TACACS+ packets.