CVE-2015-0643: High severity Cisco IOS XE vulnerability

Published Mar 26, 2015

Updated

Cisco IOS 12.2, 12.4, 15.0, 15.1, 15.2, 15.3, and 15.4 and IOS XE 2.5.x, 2.6.x, 3.1.xS through 3.12.xS before 3.12.3S, 3.2.xE through 3.7.xE before 3.7.1E, 3.3.xSG, 3.4.xSG, and 3.13.xS before 3.13.2S allow remote attackers to cause a denial of service (memory consumption and device reload) by sending malformed IKEv2 packets over (1) IPv4 or (2) IPv6, aka Bug ID CSCuo75572.

Affected Software

63 affected components

Cisco IOS XE=3.2s.0

Cisco IOS XE=3.2s.1

Cisco IOS XE=3.2s.2

Cisco IOS XE=3.3sg.0

Cisco IOS XE=3.3sg.1

Cisco IOS XE=3.3sg.2

Cisco IOS XE=3.3xo.0

Cisco IOS XE=3.3xo.1

Cisco IOS XE=3.3xo.2

Cisco IOS XE=3.4s.0

Cisco IOS XE=3.4s.1

Cisco IOS XE=3.4s.2

Cisco IOS XE=3.4s.3

Cisco IOS XE=3.4s.4

Cisco IOS XE=3.4s.5

Cisco IOS XE=3.4s.6

Cisco IOS XE=3.4sg.0

Cisco IOS XE=3.4sg.1

Cisco IOS XE=3.4sg.2

Cisco IOS XE=3.4sg.3

Cisco IOS XE=3.4sg.4

Cisco IOS XE=3.4sg.5

Cisco IOS XE=3.5e.0

Cisco IOS XE=3.5e.1

Cisco IOS XE=3.5e.2

Cisco IOS XE=3.5e.3

Cisco IOS XE=3.5s.0

Cisco IOS XE=3.5s.1

Cisco IOS XE=3.5s.2

Cisco IOS XE=3.5s_base

Cisco IOS XE=3.6e.0

Cisco IOS XE=3.6e.1

Cisco IOS XE=3.6s.0

Cisco IOS XE=3.6s.1

Cisco IOS XE=3.6s.2

Cisco IOS XE=3.6s_base

Cisco IOS XE=3.7s.1

Cisco IOS XE=3.7s.2

Cisco IOS XE=3.7s.3

Cisco IOS XE=3.7s.4

Cisco IOS XE=3.7s.5

Cisco IOS XE=3.7s.6

Cisco IOS XE=3.7s_base

Cisco IOS XE=3.8s.0

Cisco IOS XE=3.8s.1

Cisco IOS XE=3.8s.2

Cisco IOS XE=3.8s_base

Cisco IOS XE=3.9s.0

Cisco IOS XE=3.9s.1

Cisco IOS XE=3.9s.2

Cisco IOS XE=3.10s.0

Cisco IOS XE=3.10s.0a

Cisco IOS XE=3.10s.1

Cisco IOS XE=3.10s.2

Cisco IOS XE=3.11s.0

Cisco IOS XE=3.11s.1

cisco IOS=12.2

cisco IOS=12.4

cisco IOS=15.0

cisco IOS=15.1

cisco IOS=15.2

cisco IOS=15.3

cisco IOS=15.4

Event History

Mar 26, 2015

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2015-0643?

CVE-2015-0643 has been assigned a high severity rating due to its potential to cause denial of service through memory consumption and device reloads.

How do I fix CVE-2015-0643?

To mitigate CVE-2015-0643, it is recommended to upgrade to the appropriate patches provided by Cisco for your affected IOS or IOS XE version.

Which versions are affected by CVE-2015-0643?

CVE-2015-0643 affects Cisco IOS versions 12.2, 12.4, 15.0 through 15.4, and IOS XE versions 2.5.x through 3.12.xS before upgrades were implemented.

What type of vulnerability is CVE-2015-0643?

CVE-2015-0643 is a denial of service vulnerability that allows remote attackers to disrupt services on affected devices.

When was CVE-2015-0643 disclosed?

CVE-2015-0643 was publicly disclosed on March 25, 2015, coinciding with Cisco's security advisory announcement.