CVE-2015-0708: Medium severity Cisco IOS XE vulnerability

Published Apr 29, 2015

Updated

Cisco IOS 15.4S, 15.4SN, and 15.5S and IOS XE 3.13S and 3.14S allow remote attackers to cause a denial of service (device crash) by including an IANA option in a DHCPv6 Solicit message on the local network, aka Bug ID CSCur29956.

Affected Software

10 affected components

Cisco IOS XE=3.13s.0

Cisco IOS XE=3.13s.1

Cisco IOS XE=3.14s.0

cisco IOS=15.4\(3\)s

cisco IOS=15.4\(3\)s1

cisco IOS=15.4\(3\)sn1

cisco IOS=15.4s

cisco IOS=15.4sn

cisco IOS=15.5\(1\)s

cisco IOS=15.5s

Event History

Apr 29, 2015

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2015-0708?

CVE-2015-0708 has a severity rating that indicates it can lead to a denial of service due to device crashes.

How do I fix CVE-2015-0708?

To fix CVE-2015-0708, upgrade to a version of Cisco IOS or IOS XE that is not affected by this vulnerability.

What systems are affected by CVE-2015-0708?

CVE-2015-0708 affects Cisco IOS version 15.4S, 15.5S, and IOS XE versions 3.13S and 3.14S.

What type of attack does CVE-2015-0708 enable?

CVE-2015-0708 enables remote attackers to cause a denial of service by sending specially crafted DHCPv6 messages.

Can CVE-2015-0708 be exploited remotely?

Yes, CVE-2015-0708 can be exploited remotely by sending a malformed DHCPv6 Solicit message on the local network.