CVE-2015-6271: High severity cisco ios xe software vulnerability

Published Aug 31, 2015

Updated

Cisco IOS XE 2.1.0 through 2.4.3 and 2.5.0 on ASR 1000 devices, when NAT Application Layer Gateway is used, allows remote attackers to cause a denial of service (Embedded Services Processor crash) via a crafted SIP packet, aka Bug IDs CSCta74749 and CSCta77008.

Affected Software

23 affected components

Cisco IOS XE=2.1.0

Cisco IOS XE=2.1.1

Cisco IOS XE=2.1.2

Cisco IOS XE=2.1.3

Cisco IOS XE=2.2.1

Cisco IOS XE=2.2.2

Cisco IOS XE=2.2.3

Cisco IOS XE=2.3.0

Cisco IOS XE=2.3.0t

Cisco IOS XE=2.3.1t

Cisco IOS XE=2.3.2

Cisco IOS XE=2.4.0

Cisco IOS XE=2.4.1

Cisco IOS XE=2.4.2

Cisco IOS XE=2.4.3

Cisco IOS XE=2.5.0

Cisco Asr 1001

Cisco Asr 1001-x

Cisco Asr 1002

Cisco Asr 1002-x

Cisco Asr 1004

Cisco Asr 1006

Cisco Asr 1013

Event History

Aug 31, 2015

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2015-6271?

CVE-2015-6271 has a high severity rating as it allows remote attackers to cause a denial of service.

How do I fix CVE-2015-6271?

To mitigate CVE-2015-6271, upgrade to a non-vulnerable version of Cisco IOS XE that is higher than 2.5.0.

Which Cisco devices are affected by CVE-2015-6271?

Cisco IOS XE versions from 2.1.0 to 2.4.3 and 2.5.0 on ASR 1000 devices are affected by CVE-2015-6271.

What type of attack is associated with CVE-2015-6271?

CVE-2015-6271 is exploited via crafted SIP packets aimed at causing an Embedded Services Processor crash.

Is there a known workaround for CVE-2015-6271?

There is no specific workaround for CVE-2015-6271; updating to a secure version is the recommended action.