Cisco Event Response: Semi-Annual Cisco IOS Advisory Bundled Publication

September 24, 2008

Cisco released its semi-annual Cisco IOS Advisory bundled publication on September 24, 2008. The publication includes 12 Security Advisories that address 19 individual vulnerabilities in Cisco IOS Software and Cisco Unified Communications Manager. Exploits of the individual vulnerabilities could result in two different impacts, a breach in confidentiality or a denial of service.

Cisco Security Intelligence Engineering, Cisco Security IntelliShield Alert Manager, and Cisco IPS

The following table identifies Cisco Security Intelligence Engineering content, Cisco Security IntelliShield Alert Manager alerts, and Cisco IPS signatures that are associated with this Cisco publication:

Cisco Security Advisory	Cisco Applied Mitigation Bulletin	Cisco IntelliShield Alert	CVE ID	Cisco IPS Signature	CVSS Base Score
cisco-sa-20080924-iosips Cisco IOS IPS Denial of Service Vulnerability	Refer to the Workarounds section of the associated PSIRT advisory	Cisco IOS Intrusion Prevention System Feature SERVICE.DNS Signature Engine Network Traffic Handling Denial of Service Vulnerability	CVE-2008-2739	–	7.8
cisco-sa-20080924-ssl Vulnerability in Cisco IOS While Processing SSL Packet	Refer to the Workarounds section of the associated PSIRT advisory	Cisco IOS Software HTTPS Session Setup Denial of Service Vulnerability	CVE-2008-3798	–	7.8
cisco-sa-20080924-sip Multiple Cisco IOS Session Initiation Protocol Denial of Service Vulnerabilities	Identifying and Mitigating Exploitation of the Cisco IOS Software and Cisco Unified Communications Manager SIP DoS Vulnerabilities	Cisco IOS Software Session Initiation Protocol Message Memory Leak Denial of Service Vulnerability	CVE-2008-3799	–	7.8
		Cisco IOS Software and Cisco Unified Communications Manager Session Initiation Protocol Message Processing Denial of Service Vulnerability	CVE-2008-3800	–	7.8
		Cisco IOS Software and Cisco Unified Communications Manager Session Initiation Protocol Message Processing Denial of Service Vulnerability	CVE-2008-3801	–	7.8
		Cisco IOS Software and Cisco Unified Communications Manager Session Initiation Protocol Message Processing Denial of Service Vulnerability	CVE-2008-3802	–	7.8
cisco-sa-20080924-cucm Cisco Unified Communications Manager Session Initiation Protocol Denial of Service Vulnerabilities	Identifying and Mitigating Exploitation of the Cisco IOS Software and Cisco Unified Communications Manager SIP DoS Vulnerabilities	Cisco Unified Communications Manager Session Initiation Protocol Message Reload Denial of Service Vulnerability	CVE-2008-3800	–	7.1
		Cisco IOS Software and Cisco Unified Communications Manager Session Initiation Protocol Message Processing Denial of Service Vulnerability	CVE-2008-3801	–	7.8
cisco-sa-20080924-vpn Cisco IOS MPLS VPN May Leak Information	Refer to the Workarounds section of the associated PSIRT advisory	Cisco IOS Multiprotocol Label Switching Virtual Private Network Information Disclosure Issue	CVE-2008-3803	–	5.1
cisco-sa-20080924-ipc Cisco 10000, uBR10012, uBR7200 Series Devices IPC Vulnerability	Identifying and Mitigating Exploitation of the Cisco 10000, uBR10012, and uBR7200 Series Devices IPC Vulnerability and the Cisco uBR10012 Series Devices SNMP Vulnerability	Cisco IOS IPC Message Denial of Service Vulnerability	CVE-2008-3805	–	8.5
		Cisco IOS IPC Message Denial of Service Vulnerability	CVE-2008-3806	–	8.5
cisco-sa-20080924-mfi Cisco IOS MPLS Forwarding Infrastructure Denial of Service Vulnerability	Refer to the Workarounds section of the associated PSIRT advisory	Cisco IOS Multi Protocol Label Switching Forwarding Infrastructure Denial of Service Vulnerability	CVE-2008-3804	–	7.8
cisco-sa-20080924-ubr Cisco uBR10012 Series Devices SNMP Vulnerability	Identifying and Mitigating Exploitation of the Cisco 10000, uBR10012, and uBR7200 Series Devices IPC Vulnerability and the Cisco uBR10012 Series Devices SNMP Vulnerability	Cisco IOS Software Linecard Redundancy Unauthorized Access Vulnerability	CVE-2008-3807	6003-0	10.0
cisco-sa-20080924-sccp Cisco IOS NAT Skinny Call Control Protocol Vulnerability	Refer to the Workarounds section of the associated PSIRT advisory	Cisco IOS Skinny Call Control Protocol Fragmented Message Denial of Service Vulnerability	CVE-2008-3810	–	7.8
		Cisco IOS Skinny Call Control Protocol Fragmented Message Denial of Service Vulnerability	CVE-2008-3811	–	7.8
cisco-sa-20080924-multicast Multiple Multicast Vulnerabilities in Cisco IOS Software	Identifying and Mitigating Exploitation of the Multiple Multicast Vulnerabilities in Cisco IOS Software	Cisco IOS PIM Packet Reload Denial of Service Vulnerability	CVE-2008-3808	–	7.8
		Cisco IOS Gigabit Switch Router PIM Packet Processing Denial of Service Vulnerability	CVE-2008-3809	6999-0	7.8
cisco-sa-20080924-iosfw Cisco IOS Software Firewall Application Inspection Control Vulnerability	Refer to the Workarounds section of the associated PSIRT advisory	Cisco IOS Firewall Application Inspection Control Denial of Service Vulnerability	CVE-2008-3812	6989-0	7.8
cisco-sa-20080924-l2tp Cisco IOS Software Layer 2 Tunneling Protocol (L2TP) Denial of Service Vulnerability	Identifying and Mitigating Exploitation of the Cisco IOS Software Layer 2 Tunneling Protocol (L2TP) Denial of Service Vulnerability	Cisco IOS Software L2TP Packet Handling Denial of Service Vulnerability	CVE-2008-3813	–	7.8

Return to Cisco Security Center