search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Cisco IOS vulnerable to DoS via crafted PPTP packet sent to port 1723/tcp

Vulnerability Note VU#656315

Original Release Date: 2001-07-29 | Last Revised: 2004-02-23

Overview

Cisco IOS contains a vulnerability that allows an intruder to crash the router.

Description

By sending a specially crafted PPTP packet to port 1723, an intruder can crash a device running a vulnerable version of IOS. Quoting from the Cisco Advisory:


    By sending a crafted PPTP packet to a port 1723, a control PPTP port, it is possible to crash the router. This vulnerability does not require special router configuration. Enabling PPTP is sufficient to expose the vulnerability. The router will crash after it receives a single packet.
For more information, see the Cisco Advisory.

Impact

An intruder can cause a vulnerable router to crash.

Solution

Upgrade to a later version of IOS as documented in the Cisco Advisory.

Vendor Information

656315
 

CVSS Metrics

Group Score Vector
Base
Temporal
Environmental

References

Acknowledgements

Thanks to Cisco for the information contained in their advisory, upon which this document is based.

This document was written by Shawn V. Hernan.

Other Information

CVE IDs: CVE-2001-1183
Severity Metric: 20.79
Date Public: 2001-07-12
Date First Published: 2001-07-29
Date Last Updated: 2004-02-23 22:41 UTC
Document Revision: 5

Sponsored by CISA.