Test Kennung:	1.3.6.1.4.1.25623.1.0.106222
Kategorie:	CISCO
Titel:	Cisco IOS Software Point-to-Point Tunneling Protocol Server Information Disclosure Vulnerability
Zusammenfassung:	A vulnerability in the implementation of Point-to-Point Tunneling;Protocol (PPTP) server functionality in Cisco IOS Software could allow an unauthenticated, remote attacker;to access data from a packet buffer that was previously used.;;The vulnerability is due to the use of a previously used packet buffer whose content was not cleared;from memory. An attacker could exploit this vulnerability by sending a PPTP connection request to;device that is running a vulnerable release of the affected software and is configured for PPTP;server functionality. A successful exploit could allow the attacker to access up to 63 bytes of;memory that were previously used for a packet and were either destined to the device or generated by;the device. An exploit would not allow the attacker to access packet data from transit traffic. In;addition, an exploit would not allow the attacker to access arbitrary memory locations that the;attacker chooses.;;Cisco has not released software updates that address this vulnerability. There is a workaround that;addresses this vulnerability.
Beschreibung:	Summary: A vulnerability in the implementation of Point-to-Point Tunneling Protocol (PPTP) server functionality in Cisco IOS Software could allow an unauthenticated, remote attacker to access data from a packet buffer that was previously used. The vulnerability is due to the use of a previously used packet buffer whose content was not cleared from memory. An attacker could exploit this vulnerability by sending a PPTP connection request to device that is running a vulnerable release of the affected software and is configured for PPTP server functionality. A successful exploit could allow the attacker to access up to 63 bytes of memory that were previously used for a packet and were either destined to the device or generated by the device. An exploit would not allow the attacker to access packet data from transit traffic. In addition, an exploit would not allow the attacker to access arbitrary memory locations that the attacker chooses. Cisco has not released software updates that address this vulnerability. There is a workaround that addresses this vulnerability. Solution: See the referenced vendor advisory for a solution. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2016-6398 BugTraq ID: 92734 http://www.securityfocus.com/bid/92734 Cisco Security Advisory: 20160902 Cisco IOS Software Point-to-Point Tunneling Protocol Server Information Disclosure Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160902-ios http://www.securitytracker.com/id/1036732
Copyright	Copyright (C) 2016 Greenbone AG

Dies ist nur einer von 146377 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.