fkie_cve-2012-0386

GHSA-9hf6-wfwp-jr92

VAR-201203-0229

The SSHv2 implementation in Cisco IOS 12.2, 12.4, 15.0, 15.1, and 15.2 and IOS XE 2.3.x through 2.6.x and 3.1.xS through 3.4.xS before 3.4.2S allows remote attackers to cause a denial of service (device reload) via a crafted username in a reverse SSH login attempt, aka Bug ID CSCtr49064. Cisco IOS is a popular Internet operating system. An attacker can exploit this issue to cause a denial-of-service condition. This issue is being tracked by Cisco Bug ID CSCtr49064.

For more information: SA48609

The vulnerability is reported in versions 2.3.x, 2.4.x, 2.5.x, 2.6.x, 3.1.xS, 3.2.xS, and 3.3.xS. Repeated exploits could create a sustained DoS condition. Devices that are not configured to accept SSHv2 connections are not affected by this vulnerability.

Cisco has released free software updates that address this vulnerability. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120328-ssh

Note: The March 28, 2012, Cisco IOS Software Security Advisory bundled publication includes nine Cisco Security Advisories. Each advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all vulnerabilities in the March 2012 bundled publication. Only SSHv2 is affected.

To determine if SSH is enabled, use the show ip ssh command. Router#show ip ssh SSH Enabled - version 2.0 Authen…

Most recent entries from all

bdu:2014-00030

fkie_cve-2012-0386

GHSA-9hf6-wfwp-jr92

gsd-2012-0386

VAR-201203-0229