CVE-2015-6273: High severity cisco ios xe software vulnerability

Published Aug 29, 2015

Updated

Cisco IOS XE before 3.1.2S on ASR 1000 devices mishandles the automatic setup of Virtual Fragment Reassembly (VFR) by certain firewall and NAT components, which allows remote attackers to cause a denial of service (Embedded Services Processor crash) via crafted IP packets, aka Bug IDs CSCtf87624, CSCte93229, CSCtd19103, and CSCti63623.

Affected Software

12 affected components

Cisco IOS XE=2.2.1

Cisco IOS XE=2.2.2

Cisco IOS XE=2.2.3

Cisco IOS XE=3.1.0s

Cisco IOS XE=3.1.1s

Cisco Asr 1001

Cisco Asr 1001-x

Cisco Asr 1002

Cisco Asr 1002-x

Cisco Asr 1004

Cisco Asr 1006

Cisco Asr 1013

Event History

Aug 29, 2015

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2015-6273?

CVE-2015-6273 has a high severity rating as it can allow remote attackers to cause a denial of service.

How do I fix CVE-2015-6273?

To fix CVE-2015-6273, upgrade to Cisco IOS XE versions 3.1.2S or later.

What are the affected devices for CVE-2015-6273?

CVE-2015-6273 affects Cisco IOS XE versions 2.2.1, 2.2.2, 2.2.3, and 3.1.0s and 3.1.1s on ASR 1000 devices.

What kind of attacks does CVE-2015-6273 enable?

CVE-2015-6273 allows attackers to send crafted IP packets that can crash the Embedded Services Processor.

What components are mishandled in CVE-2015-6273?

CVE-2015-6273 involves mishandling in the automatic setup of Virtual Fragment Reassembly by certain firewall and NAT components.