{"vuid":"VU#642076","idnumber":"642076","name":"Cisco Intrusion Prevention System administration interface fails to properly handle Secure Socket Layer packets","keywords":["Cisco","Intrusion Prevention System Management","DoS","denial of service","SSlv2 Client","Hello packet"],"overview":"The web administration interface of the Cisco Intrusion Prevention System and the Cisco Intrusion Detection System devices fails to properly handle certain secure socket layer packets. This vulnerability may cause a denial of service.","clean_desc":"According to Cisco Security Advisory cisco-sa-20060920-ips: It is possible to send a malformed SSLv2 Client Hello packet to the IPS/IDS web administration interface, which may cause the process (mainApp) responsible for managing remote access to fail. This results in an IPS/IDS device becoming unresponsive to all future remote management requests through the web administration interface or the command-line interface (CLI) via SSH and the console. The specific nature of the malformed packets that exploit this vulnerability is unknown. Vulnerable products include Cisco IDS 4.1(x) software prior to 4.1(5c), Cisco IPS 5.0(x) software prior to 5.0(6p1), and Cisco IPS 5.1(x) software prior to 5.1(2).","impact":"A remote, unauthenticated attacker could cause the administrative interface of an affected device to become unavailable, leading to various secondary denial-of-service impacts.","resolution":"Upgrade\nCisco has made available corrected versions of the software to address these vulnerabilities. For more information, see Cisco Security Advisory cisco-sa-20060920-ips.","workarounds":"Apply Access Control List Users who are unable to upgrade should apply an access control list (ACL) on the vulnerable device to restrict access to trusted management systems. Details on creating and uploading an ACL can be found in Cisco's Product Configuration Guide.","sysaffected":"","thanks":"This issue was reported in Cisco Security Advisory cisco-sa-20060920-ips","author":"This document was written by Chris Taschner.","public":["http://www.cisco.com/warp/public/707/cisco-sa-20060920-ips.shtml","http://secunia.com/advisories/22046/","http://www.cisco.com/en/US/products/hw/vpndevc/ps4077/products_configuration_guide_chapter09186a008055df9a.html#wp1031536","http://www.securityfocus.com/bid/20124","http://secunia.com/advisories/22046","http://xforce.iss.net/xforce/xfdb/29056"],"cveids":["CVE-2006-4910"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2006-09-20T17:12:06Z","publicdate":"2006-09-20T00:00:00Z","datefirstpublished":"2006-09-22T16:53:14Z","dateupdated":"2006-09-26T16:03:54Z","revision":22,"vrda_d1_directreport":"0","vrda_d1_population":"3","vrda_d1_impact":"3","cam_widelyknown":"15","cam_exploitation":"0","cam_internetinfrastructure":"10","cam_population":"10","cam_impact":"3","cam_easeofexploitation":"13","cam_attackeraccessrequired":"20","cam_scorecurrent":"3.65625","cam_scorecurrentwidelyknown":"4.3875","cam_scorecurrentwidelyknownexploited":"7.3125","ipprotocol":"","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":3.65625,"vulnote":null}