CVE-2007-0918
published 2007-02-14CVE-2007-0918: The ATOMIC.TCP signature engine in the Intrusion Prevention System (IPS) feature for Cisco IOS 12.4XA, 12.3YA, 12.3T, and other trains allows remote attackers…
PriorityP427high7.1CVSS 2.0
AVNACMAuNCNINAC
EPSS
3.11%
86.4th percentile
The ATOMIC.TCP signature engine in the Intrusion Prevention System (IPS) feature for Cisco IOS 12.4XA, 12.3YA, 12.3T, and other trains allows remote attackers to cause a denial of service (IPS crash and traffic loss) via unspecified manipulations that are not properly handled by the regular expression feature, as demonstrated using the 3123.0 (Netbus Pro Traffic) signature.
Affected
25 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
CVSS provenance
nvdv2.07.1HIGHAV:N/AC:M/Au:N/C:N/I:N/A:C
vendor_cisco4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Multiple IOS IPS Vulnerabilities
vendor_cisco·2007-02-13·CVSS 4.7
CVE-2007-0917 [MEDIUM] CWE-399 Multiple IOS IPS Vulnerabilities
Multiple IOS IPS Vulnerabilities
The Intrusion Prevention System (IPS) feature set of Cisco IOS®
contains several vulnerabilities. These include:
Fragmented IP packets may be used to evade signature
inspection.
IPS signatures utilizing the regular expression feature of the
ATOMIC.TCP signature engine may cause a router to crash resulting in a denial
of service.
There are mitigations and workarounds for these vulnerabilities. Cisco
has made free software available to address these vulnerabilities for affected
customers.
This advisory is posted at
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20070213-iosips.
Cisco
Multiple IOS IPS Vulnerabilities
vendor_cisco
CVE-2007-0918 Multiple IOS IPS Vulnerabilities
CVE-2007-0918: Multiple IOS IPS Vulnerabilities
The Intrusion Prevention System (IPS) feature set of Cisco IOS� contains several vulnerabilities. These include: Fragmented IP packets may be used to evade signature inspection. IPS signatures utilizing the regular expression feature of the ATOMIC.TCP signature engine may cause a router to crash resulting in a denial of service. There are mitigations and
CWE: CWE-399, CWE-399
Bug IDs: CSCsa53334, CSCsg15598, CSCsg15598, CSCsa53334, CSCsg15598
GHSA
GHSA-q9c9-whcq-8v29: The ATOMIC
ghsa_unreviewed·2022-05-01
CVE-2007-0918 [HIGH] CWE-20 GHSA-q9c9-whcq-8v29: The ATOMIC
The ATOMIC.TCP signature engine in the Intrusion Prevention System (IPS) feature for Cisco IOS 12.4XA, 12.3YA, 12.3T, and other trains allows remote attackers to cause a denial of service (IPS crash and traffic loss) via unspecified manipulations that are not properly handled by the regular expression feature, as demonstrated using the 3123.0 (Netbus Pro Traffic) signature.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://osvdb.org/33053http://secunia.com/advisories/24142http://www.cisco.com/en/US/products/products_security_advisory09186a00807e0a5b.shtmlhttp://www.cisco.com/en/US/products/products_security_response09186a00807e0a5e.htmlhttp://www.securityfocus.com/bid/22549http://www.securitytracker.com/id?1017631http://www.vupen.com/english/advisories/2007/0597https://exchange.xforce.ibmcloud.com/vulnerabilities/32474https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5832http://osvdb.org/33053http://secunia.com/advisories/24142http://www.cisco.com/en/US/products/products_security_advisory09186a00807e0a5b.shtmlhttp://www.cisco.com/en/US/products/products_security_response09186a00807e0a5e.htmlhttp://www.securityfocus.com/bid/22549http://www.securitytracker.com/id?1017631http://www.vupen.com/english/advisories/2007/0597https://exchange.xforce.ibmcloud.com/vulnerabilities/32474https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5832
2007-02-14
Published