CVE-2013-0149

(ospfd): Possibility to use invalid / duplicate LSA information (VU#229804)

Published Aug 3, 2013 CVSS 2.0 · 5.8 Medium EPSS 2.5% KEV · Not listed
Description
The OSPF implementation in Cisco IOS 12.0 through 12.4 and 15.0 through 15.3, IOS-XE 2.x through 3.9.xS, ASA and PIX 7.x through 9.1, FWSM, NX-OS, and StarOS before 14.0.50488 does not properly validate Link State Advertisement (LSA) type 1 packets before performing operations on the LSA database, which allows remote attackers to cause a denial of service (routing disruption) or obtain sensitive packet information via a (1) unicast or (2) multicast packet, aka Bug IDs CSCug34485, CSCug34469, CSCug39762, CSCug63304, and CSCug39795.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2013-0192 The OSPF implementation in Cisco IOS 12.0 through 12.4 and 15.0 through 15.3, IOS-XE 2.x through 3.9.xS, ASA and PIX 7.x through 9.1, FWSM, NX-OS, and StarOS before 14.0.50488 does not properly validate Link State Advertisement (LSA) type 1 packets before performing operations on the LSA database, which allows remote attackers to cause a denial of service (routing disruption) or obtain sensitive packet information via a (1) unicast or (2) multicast packet, aka Bug IDs CSCug34485, CSCug34469, CSCug39762, CSCug63304, and CSCug39795.
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
certcc
Published
Updated
Aug 6, 2024, 2:18 PM
Reserved
Dec 6, 2012, 12:00 AM
Status
Modified
Published
Aug 5, 2013, 1:22 PM
Modified
Jun 16, 2026, 11:48 PM
Severity
Moderate
Public date
Aug 1, 2013, 12:00 AM