漏洞标题
N/A
漏洞描述信息
在Cisco IOS XE软件中，边界网关协议(BGP)在以太网虚拟私有网络(EVPN)上的一个漏洞可能导致无验证的远程攻击者使设备重新加载，导致服务拒绝(DoS)状态，或者可能导致BGP路由表被 corrupt，这可能导致网络不稳定。该漏洞的存在是由于在IOS XE软件发布之间，BGP基于mpls的以太网虚拟专用网(IPvVPN) RFC(RFC 7432)草案的实施发生了变化。当收到BGP Inclusive Multicast Ethernet Tag Route或BGP EVPN MAC/IP 广告路由更新包时，可能存在IP地址长度字段计算错误。攻击者可以利用此漏洞，通过在BGP会话建立后向受影响的设备发送精心构造的BGP包来利用它。利用此漏洞可以使攻击者使受影响的设备重新加载或 corrupt BGP路由表；任何一种结果都将导致DoS。路由器收到一个由已存在的BGP会话中的 peer 发送的精心构造的BGP消息时，该漏洞可能会被触发。该漏洞对所有支持BGP EVPN配置的Cisco IOS XE软件版本16.3之前的软件发布都受到影响。如果设备没有被配置为EVPN，则它不会受到漏洞的影响。Cisco Bug ID: CSCui67191, CSCvg52875。
CVSS信息
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
漏洞类别
N/A
漏洞标题
N/A
漏洞描述信息
A vulnerability in the Border Gateway Protocol (BGP) over an Ethernet Virtual Private Network (EVPN) for Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload, resulting in a denial of service (DoS) condition, or potentially corrupt the BGP routing table, which could result in network instability. The vulnerability exists due to changes in the implementation of the BGP MPLS-Based Ethernet VPN RFC (RFC 7432) draft between IOS XE software releases. When the BGP Inclusive Multicast Ethernet Tag Route or BGP EVPN MAC/IP Advertisement Route update packet is received, it could be possible that the IP address length field is miscalculated. An attacker could exploit this vulnerability by sending a crafted BGP packet to an affected device after the BGP session was established. An exploit could allow the attacker to cause the affected device to reload or corrupt the BGP routing table; either outcome would result in a DoS. The vulnerability may be triggered when the router receives a crafted BGP message from a peer on an existing BGP session. This vulnerability affects all releases of Cisco IOS XE Software prior to software release 16.3 that support BGP EVPN configurations. If the device is not configured for EVPN, it is not vulnerable. Cisco Bug IDs: CSCui67191, CSCvg52875.
CVSS信息
N/A
漏洞类别
输入验证不恰当
漏洞标题
Cisco IOS XE Software Ethernet Virtual Private Network 安全漏洞
漏洞描述信息
Cisco IOS XE Software是美国思科（Cisco）公司为其网络设备开发的一套操作系统。Ethernet Virtual Private Network（EVPN）是其中的一个以太网虚拟专用网络系统。Border Gateway Protocol（BGP）是其中的一个边界网关协议。 Cisco IOS XE Software 16.3之前的版本中EVPN的BGP存在拒绝服务漏洞。远程攻击者可通过在BGP会话建立之后，向受影响的设备发送特制的数据包利用该漏洞造成拒绝服务（设备重新加载或BGP路
CVSS信息
N/A
漏洞类别
输入验证错误