Overview
Cisco IOS fails to properly handle summary packets in the VLAN Trunking Protocol. This vulnerability may allow a remote, unauthenticated attacker to cause a denial-of-service condition.
Description
Cisco's VLAN Trunking Protocol (VTP) provides the ability to manage the addition, deletion, and renaming of Virtual Local Area Networks (VLANs) across an entire network. VTP is supported on a number of different Cisco products in both the IOS and CatOS operating systems. According to Cisco Systems: When a switch receives a specially crafted summary packet, the switch will reset with a Software Forced Crash Exception. Messages for either "watchdog timeout" or "CPU hog" for process VLAN Manager will be seen prior to the software reset within the syslog messages generated by the switch. The packets must be received on a trunk enabled port. |
Impact
A remote, unauthenticated attacker may be able to cause a denial of service condition. |
Solution
Upgrade IOS |
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
Acknowledgements
This issue was reported in Cisco Security Response cisco-sr-20060913-vtp. Cisco credits FX of Phenoelit for reporting this issue.
This document was written by Chris Taschner.
Other Information
| CVE IDs: | CVE-2006-4774 |
| Severity Metric: | 12.40 |
| Date Public: | 2006-09-13 |
| Date First Published: | 2006-09-28 |
| Date Last Updated: | 2006-09-28 12:29 UTC |
| Document Revision: | 23 |