CVE-2016-1407: Input Validation

Published May 25, 2016

Updated

Cisco IOS XR through 5.3.2 mishandles Local Packet Transport Services (LPTS) flow-base entries, which allows remote attackers to cause a denial of service (session drop) by making many connection attempts to open TCP ports, aka Bug ID CSCux95576.

Affected Software

85 affected components

Cisco IOS XR=2.0.0

Cisco IOS XR=3.0.0

Cisco IOS XR=3.0.1

Cisco IOS XR=3.2.0

Cisco IOS XR=3.2.1

Cisco IOS XR=3.2.2

Cisco IOS XR=3.2.3

Cisco IOS XR=3.2.4

Cisco IOS XR=3.2.6

Cisco IOS XR=3.2.50

Cisco IOS XR=3.3.0

Cisco IOS XR=3.3.1

Cisco IOS XR=3.3.2

Cisco IOS XR=3.3.3

Cisco IOS XR=3.3.4

Cisco IOS XR=3.4.0

Cisco IOS XR=3.4.1

Cisco IOS XR=3.4.2

Cisco IOS XR=3.4.3

Cisco IOS XR=3.5.0

Cisco IOS XR=3.5.2

Cisco IOS XR=3.5.3

Cisco IOS XR=3.5.4

Cisco IOS XR=3.6.0

Cisco IOS XR=3.6.1

Cisco IOS XR=3.6.2

Cisco IOS XR=3.6.3

Cisco IOS XR=3.6_base

Cisco IOS XR=3.7.0

Cisco IOS XR=3.7.1

Cisco IOS XR=3.7.2

Cisco IOS XR=3.7.3

Cisco IOS XR=3.7_base

Cisco IOS XR=3.8.0

Cisco IOS XR=3.8.1

Cisco IOS XR=3.8.2

Cisco IOS XR=3.8.3

Cisco IOS XR=3.8.4

Cisco IOS XR=3.9.0

Cisco IOS XR=3.9.1

Cisco IOS XR=3.9.2

Cisco IOS XR=3.9.3

Cisco IOS XR=4.0.0

Cisco IOS XR=4.0.1

Cisco IOS XR=4.0.2

Cisco IOS XR=4.0.3

Cisco IOS XR=4.0.4

Cisco IOS XR=4.0.11

Cisco IOS XR=4.0_base

Cisco IOS XR=4.1.0

Cisco IOS XR=4.1.1

Cisco IOS XR=4.1.2

Cisco IOS XR=4.1_base

Cisco IOS XR=4.2.0

Cisco IOS XR=4.2.1

Cisco IOS XR=4.2.2

Cisco IOS XR=4.2.3

Cisco IOS XR=4.2.4

Cisco IOS XR=4.3.0

Cisco IOS XR=4.3.1

Cisco IOS XR=4.3.2

Cisco IOS XR=4.3.3

Cisco IOS XR=4.3.4

Cisco IOS XR=5.0.0

Cisco IOS XR=5.0.1

Cisco IOS XR=5.0_base

Cisco IOS XR=5.1.0

Cisco IOS XR=5.1.1.k9sec

Cisco IOS XR=5.1.2

Cisco IOS XR=5.1.3

Cisco IOS XR=5.2.0

Cisco IOS XR=5.2.1

Cisco IOS XR=5.2.2

Cisco IOS XR=5.2.3

Cisco IOS XR=5.2.4

Cisco IOS XR=5.2.5

Cisco IOS XR=5.3.0

Cisco IOS XR=5.3.1

Cisco IOS XR=5.3.2

Cisco Asr 9001

Cisco Asr 9006

Cisco Asr 9010

Cisco Asr 9904

Cisco Asr 9912

Cisco Asr 9922

Event History

May 25, 2016

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2016-1407?

CVE-2016-1407 has been classified with a severity rating that indicates it can lead to a denial of service condition.

How do I fix CVE-2016-1407?

To fix CVE-2016-1407, it is recommended to upgrade to a patched version of Cisco IOS XR that addresses this vulnerability.

Which versions of Cisco IOS XR are affected by CVE-2016-1407?

CVE-2016-1407 affects Cisco IOS XR versions through 5.3.2.

What are the potential impacts of CVE-2016-1407?

The potential impacts of CVE-2016-1407 include remote attackers being able to cause session drops through excessive connection attempts.

Is there a known exploit for CVE-2016-1407?

Yes, CVE-2016-1407 is known to be potentially exploitable by remote attackers to achieve a denial of service.