search menu icon-carat-right cmu-wordmark

CERT Coordination Center


Cisco IOS discloses fragments of previous packets when Express Forwarding is enabled

Vulnerability Note VU#310387

Original Release Date: 2002-03-04 | Last Revised: 2002-03-05

Overview

A vulnerability exists in multiple versions of Cisco's Internetworking Operating System (IOS) software that allows an attacker to collect fragments of previously processed packets.

Description

Many networking devices running Cisco IOS with Cisco Express Forwarding (CEF) enabled contain a vulnerability that allows an attacker to collect fragments of previously processed packets. When the header of an incoming IP packet specifies an IP packet length that is greater than the length specified by the physical layer (eg. MAC) header, affected Cisco devices will extend the physical layer packet to meet the length specified in the IP header. The data used for this extension is taken from a buffer that contains previously processed packets, so it is possible for affected devices to include fragments of an older packet in the extended packet.

For information regarding affected products and versions, please consult the vendor section of this document.

Impact

This vulnerability creates an information leak that allows an attacker to obtain fragments of previously processed packets.

Solution

Apply a patch from Cisco

Cisco has provided patches for affected versions of the IOS software. For further details, please consult the vendor section of this document.

Disable Cisco Express Forwarding


If it is not possible or practical to immediately patch an affected device, disabling CEF will prevent exploitation of this vulnerability.

Vendor Information

310387
Expand all

Cisco

Notified:  February 27, 2002 Updated:  March 04, 2002

Status

  Vulnerable

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

Cisco has published a Security Advisory regarding this issue. For the latest information on this vulnerability, please see:


CVSS Metrics

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A

References

Credit

The CERT/CC thanks Cisco for the information contained in their advisory.

This document was written by Jeffrey P Lanza and is based on information from the Cisco advisory.

Other Information

CVE IDs: None
Severity Metric: 3.94
Date Public: 2002-02-27
Date First Published: 2002-03-04
Date Last Updated: 2002-03-05 22:59 UTC
Document Revision: 19

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.