ID de Prueba:	1.3.6.1.4.1.25623.1.0.106222
Categoría:	CISCO
Título:	Cisco IOS Software Point-to-Point Tunneling Protocol Server Information Disclosure Vulnerability
Resumen:	A vulnerability in the implementation of Point-to-Point Tunneling;Protocol (PPTP) server functionality in Cisco IOS Software could allow an unauthenticated, remote attacker;to access data from a packet buffer that was previously used.;;The vulnerability is due to the use of a previously used packet buffer whose content was not cleared;from memory. An attacker could exploit this vulnerability by sending a PPTP connection request to;device that is running a vulnerable release of the affected software and is configured for PPTP;server functionality. A successful exploit could allow the attacker to access up to 63 bytes of;memory that were previously used for a packet and were either destined to the device or generated by;the device. An exploit would not allow the attacker to access packet data from transit traffic. In;addition, an exploit would not allow the attacker to access arbitrary memory locations that the;attacker chooses.;;Cisco has not released software updates that address this vulnerability. There is a workaround that;addresses this vulnerability.
Descripción:	Summary: A vulnerability in the implementation of Point-to-Point Tunneling Protocol (PPTP) server functionality in Cisco IOS Software could allow an unauthenticated, remote attacker to access data from a packet buffer that was previously used. The vulnerability is due to the use of a previously used packet buffer whose content was not cleared from memory. An attacker could exploit this vulnerability by sending a PPTP connection request to device that is running a vulnerable release of the affected software and is configured for PPTP server functionality. A successful exploit could allow the attacker to access up to 63 bytes of memory that were previously used for a packet and were either destined to the device or generated by the device. An exploit would not allow the attacker to access packet data from transit traffic. In addition, an exploit would not allow the attacker to access arbitrary memory locations that the attacker chooses. Cisco has not released software updates that address this vulnerability. There is a workaround that addresses this vulnerability. Solution: See the referenced vendor advisory for a solution. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2016-6398 BugTraq ID: 92734 http://www.securityfocus.com/bid/92734 Cisco Security Advisory: 20160902 Cisco IOS Software Point-to-Point Tunneling Protocol Server Information Disclosure Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160902-ios http://www.securitytracker.com/id/1036732
Copyright	Copyright (C) 2016 Greenbone AG

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.