CVE-2019-12655

A vulnerability in the FTP application layer gateway (ALG) functionality used by Network Address Translation (NAT), NAT IPv6 to IPv4 (NAT64), and the Zone-Based Policy Firewall (ZBFW) in Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to a buffer overflow that occurs when an affected device inspects certain FTP traffic. An attacker could exploit this vulnerability by performing a specific FTP transfer through the device. A successful exploit could allow the attacker to cause the device to reload.

CVSS v3 7.5 HIGH
CVSS v2.0 7.8 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

7.8^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:C

Exploitability : 10.0 / Impact : 6.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact COMPLETE

References

Link	Resource
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-ftp	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:cisco:ios::::::::
	cpe:2.3:o:cisco:ios::::::::
	cpe:2.3:o:cisco:ios:16.6.4:::::::*
	cpe:2.3:o:cisco:ios:16.6.5:::::::*
	cpe:2.3:o:cisco:ios:16.9.1:::::::*
	cpe:2.3:o:cisco:ios:16.9.2:::::::*

History

No history.

Information

Published : 2019-09-25 21:15

Updated : 2023-12-10 13:13

NVD link : CVE-2019-12655

Mitre link : CVE-2019-12655

CVE.ORG link : CVE-2019-12655

JSON object : View

Products Affected

cisco

ios

CWE

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CWE-20

Improper Input Validation

{"id": "CVE-2019-12655", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 6.9, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Secondary", "source": "ykramarz@cisco.com", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 3.9}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2019-09-25T21:15:10.780", "references": [{"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-ftp", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-120"}]}, {"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the FTP application layer gateway (ALG) functionality used by Network Address Translation (NAT), NAT IPv6 to IPv4 (NAT64), and the Zone-Based Policy Firewall (ZBFW) in Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to a buffer overflow that occurs when an affected device inspects certain FTP traffic. An attacker could exploit this vulnerability by performing a specific FTP transfer through the device. A successful exploit could allow the attacker to cause the device to reload."}, {"lang": "es", "value": "Una vulnerabilidad en la funcionalidad application layer gateway (ALG) de FTP, utilizada por Network Address Translation (NAT), NAT IPv6 a IPv4 (NAT64) y el Zone-Based Policy Firewall (ZBFW) en Software Cisco IOS XE, podr\u00eda permitir a un atacante remoto no autenticado causar que un dispositivo afectado se recargue. La vulnerabilidad es debido a un desbordamiento de b\u00fafer que ocurre cuando un dispositivo afectado inspecciona determinado tr\u00e1fico FTP. Un atacante podr\u00eda explotar esta vulnerabilidad realizando una transferencia FTP espec\u00edfica por medio del dispositivo. Una explotaci\u00f3n con \u00e9xito podr\u00eda permitir al atacante causar que el dispositivo se recargue."}], "lastModified": "2019-10-09T23:45:58.730", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cisco:ios:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6B9F41C8-A600-4074-9A69-6506493BEE54", "versionEndExcluding": "16.3.8", "versionStartIncluding": "3.16.8s"}, {"criteria": "cpe:2.3:o:cisco:ios:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4C993A5E-D1F2-4F80-BC25-5F927BC3C0D5", "versionEndExcluding": "16.11.1", "versionStartIncluding": "16.10.1"}, {"criteria": "cpe:2.3:o:cisco:ios:16.6.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3AA6B13C-245C-405E-AD13-CEAA0EF72AA0"}, {"criteria": "cpe:2.3:o:cisco:ios:16.6.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8A0118CA-E0F2-44C0-9956-98E5E9FB2C73"}, {"criteria": "cpe:2.3:o:cisco:ios:16.9.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D2245824-4120-42D0-922E-F01380704573"}, {"criteria": "cpe:2.3:o:cisco:ios:16.9.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3C771AC8-80D6-4DB2-B1E0-1C0D18FB4D06"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}