CVE-2014-3276

Cisco Identity Services Engine (ISE) 1.2(.1 patch 2) and earlier does not properly handle deadlock conditions during reception of crafted RADIUS accounting packets from multiple NAS devices, which allows remote authenticated users to cause a denial of service (RADIUS outage) by sourcing these packets from two origins, aka Bug ID CSCuo56780.

CVSS v2.0 4.0 MEDIUM

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:N/I:N/A:P

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3276	Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=34329	Vendor Advisory
http://www.securitytracker.com/id/1030274	Third Party Advisory VDB Entry
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3276	Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=34329	Vendor Advisory
http://www.securitytracker.com/id/1030274	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:cisco:identity_services_engine_software::::::::
	cpe:2.3:a:cisco:identity_services_engine_software:1.0:::::::*
	cpe:2.3:a:cisco:identity_services_engine_software:1.1:::::::*

History

21 Nov 2024, 02:07

Type	Values Removed	Values Added
References	~~() http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3276 - Vendor Advisory~~	() http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3276 - Vendor Advisory
References	~~() http://tools.cisco.com/security/center/viewAlert.x?alertId=34329 - Vendor Advisory~~	() http://tools.cisco.com/security/center/viewAlert.x?alertId=34329 - Vendor Advisory
References	~~() http://www.securitytracker.com/id/1030274 - Third Party Advisory, VDB Entry~~	() http://www.securitytracker.com/id/1030274 - Third Party Advisory, VDB Entry

Information

Published : 2014-05-26 00:25

Updated : 2024-11-21 02:07

NVD link : CVE-2014-3276

Mitre link : CVE-2014-3276

CVE.ORG link : CVE-2014-3276

JSON object : View

Products Affected

cisco

identity_services_engine_software

CWE

CWE-399

Resource Management Errors

{"id": "CVE-2014-3276", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2014-05-26T00:25:31.470", "references": [{"url": "http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3276", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "http://tools.cisco.com/security/center/viewAlert.x?alertId=34329", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securitytracker.com/id/1030274", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3276", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://tools.cisco.com/security/center/viewAlert.x?alertId=34329", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securitytracker.com/id/1030274", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-399"}]}], "descriptions": [{"lang": "en", "value": "Cisco Identity Services Engine (ISE) 1.2(.1 patch 2) and earlier does not properly handle deadlock conditions during reception of crafted RADIUS accounting packets from multiple NAS devices, which allows remote authenticated users to cause a denial of service (RADIUS outage) by sourcing these packets from two origins, aka Bug ID CSCuo56780."}, {"lang": "es", "value": "Cisco Identity Services Engine (ISE) 1.2(.1 patch 2) y anteriores no maneja debidamente condiciones de bloqueo durante la recepci\u00f3n de paquetes de contabilidad RADIUS manipulados de m\u00faltiples dispositivos NAS, lo que permite a usuarios remotos autenticados causar una denegaci\u00f3n de servicio (RADIUS outage) mediante la obtenci\u00f3n de estos paquetes de dos origines, tambi\u00e9n conocido como Bug ID CSCuo56780."}], "lastModified": "2024-11-21T02:07:46.573", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:identity_services_engine_software:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "63BC1BB0-33FB-4CBC-99AD-E9E6593B2A11", "versionEndIncluding": "1.2"}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine_software:1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CA49BB84-9E6B-4510-B2DF-178C2E6C0CBE"}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine_software:1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "50CE032F-3BD1-462D-B2DD-4088EA7CE037"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}