CVE-2015-4277 : The global-configuration implementation on Cisco ASR 9000 devices with software

The global-configuration implementation on Cisco ASR 9000 devices with software 5.1.3 and 5.3.0 improperly closes vty sessions after a commit/end operation, which allows local users to cause a denial of service (tmp/*config file creation, memory consumption, and device hang) via unspecified vectors, aka Bug ID CSCut93842.

Published 2015-08-19 18:59:00

Updated 2017-09-21 01:29:09

Source Cisco Systems, Inc.

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2015-4277

Cisco » Nx-os » Version: 5.3.0
cpe:2.3:o:cisco:nx-os:5.3.0:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Nexus 93120tx » Version: N/A
When used together with: Cisco » Nexus 93128tx » Version: N/A
When used together with: Cisco » Nexus 9332pq » Version: N/A
When used together with: Cisco » Nexus 9336pq Aci Spine » Version: N/A
When used together with: Cisco » Nexus 9372px » Version: N/A
When used together with: Cisco » Nexus 9372tx » Version: N/A
When used together with: Cisco » Nexus 9396px » Version: N/A
When used together with: Cisco » Nexus 9396tx » Version: N/A
When used together with: Cisco » Nexus 9504 » Version: N/A
When used together with: Cisco » Nexus 9508 » Version: N/A
When used together with: Cisco » Nexus 9516 » Version: N/A
Cisco » Nx-os » Version: 5.1.3
cpe:2.3:o:cisco:nx-os:5.1.3:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Nexus 93120tx » Version: N/A
When used together with: Cisco » Nexus 93128tx » Version: N/A
When used together with: Cisco » Nexus 9332pq » Version: N/A
When used together with: Cisco » Nexus 9336pq Aci Spine » Version: N/A
When used together with: Cisco » Nexus 9372px » Version: N/A
When used together with: Cisco » Nexus 9372tx » Version: N/A
When used together with: Cisco » Nexus 9396px » Version: N/A
When used together with: Cisco » Nexus 9396tx » Version: N/A
When used together with: Cisco » Nexus 9504 » Version: N/A
When used together with: Cisco » Nexus 9508 » Version: N/A
When used together with: Cisco » Nexus 9516 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2015-4277

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 6 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2015-4277

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
4.9	MEDIUM	AV:L/AC:L/Au:N/C:N/I:N/A:C	3.9	6.9	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Complete

CWE ids for CVE-2015-4277

CWE-399

Assigned by: nvd@nist.gov (Primary)

References for CVE-2015-4277

http://tools.cisco.com/security/center/viewAlert.x?alertId=39939

Cisco ASR 9000 Series Aggregation Services Routers tmp Files Denial of Service Vulnerability
Vendor Advisory
http://www.securitytracker.com/id/1033259

Cisco ASR 9000 Series Router vty Session Closing Bug Lets Local Users Consume Excessive Memory Resources - SecurityTracker

Jump to

Vulnerability Details : CVE-2015-4277

Products affected by CVE-2015-4277

Exploit prediction scoring system (EPSS) score for CVE-2015-4277

CVSS scores for CVE-2015-4277

CWE ids for CVE-2015-4277

References for CVE-2015-4277