CVE-2008-1156
published 2008-03-27CVE-2008-1156: Unspecified vulnerability in the Multicast Virtual Private Network (MVPN) implementation in Cisco IOS 12.0, 12.2, 12.3, and 12.4 allows remote attackers to…
PriorityP427medium5.1CVSS 2.0
AVNACHAuNCPIPAP
EPSS
2.71%
84.4th percentile
Unspecified vulnerability in the Multicast Virtual Private Network (MVPN) implementation in Cisco IOS 12.0, 12.2, 12.3, and 12.4 allows remote attackers to create "extra multicast states on the core routers" via a crafted Multicast Distribution Tree (MDT) Data Join message.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_ios | — | — |
| cisco | cisco_ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
CVSS provenance
nvdv2.05.1MEDIUMAV:N/AC:H/Au:N/C:P/I:P/A:P
vendor_cisco7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco IOS Multicast Virtual Private Network (MVPN) Data Leak
vendor_cisco·2008-03-26·CVSS 7.5
CVE-2008-1156 [HIGH] CWE-399 Cisco IOS Multicast Virtual Private Network (MVPN) Data Leak
Cisco IOS Multicast Virtual Private Network (MVPN) Data Leak
A vulnerability in the Cisco implementation of Multicast Virtual
Private Network (MVPN) is subject to exploitation that can allow a malicious
user to create extra multicast states on the core routers or receive multicast
traffic from other Multiprotocol Label Switching (MPLS) based Virtual Private
Networks (VPN) by sending specially crafted messages.
Cisco has released software updates that address this vulnerability. Workarounds that mitigate this vulnerability are
available.
This advisory is posted at
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20080326-mvpn.
Note: The March 26, 2008 publication
includes five Security Advisories. The Advisories all affect Cisco IOS. Each
Advisory l
Cisco
Cisco IOS Multicast Virtual Private Network (MVPN) Data Leak
vendor_cisco
CVE-2008-1156 Cisco IOS Multicast Virtual Private Network (MVPN) Data Leak
CVE-2008-1156: Cisco IOS Multicast Virtual Private Network (MVPN) Data Leak
A vulnerability in the Cisco implementation of Multicast Virtual Private Network (MVPN) is subject to exploitation that can allow a malicious user to create extra multicast states on the core routers or receive multicast traffic from other Multiprotocol Label Switching (MPLS) based Virtual Private Networks (VPN) by sending specially crafted messages. Cisco has released software updates that address this vulnerability.
CWE: CWE-399, CWE-399
Bug IDs: CSCsi01470, CSCsi01470, CSCsi01470
GHSA
GHSA-4c4p-4x55-3pgj: Unspecified vulnerability in the Multicast Virtual Private Network (MVPN) implementation in Cisco IOS 12
ghsa_unreviewed·2022-05-01
CVE-2008-1156 [MEDIUM] GHSA-4c4p-4x55-3pgj: Unspecified vulnerability in the Multicast Virtual Private Network (MVPN) implementation in Cisco IOS 12
Unspecified vulnerability in the Multicast Virtual Private Network (MVPN) implementation in Cisco IOS 12.0, 12.2, 12.3, and 12.4 allows remote attackers to create "extra multicast states on the core routers" via a crafted Multicast Distribution Tree (MDT) Data Join message.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://secunia.com/advisories/29507http://www.cisco.com/warp/public/707/cisco-sa-20080326-mvpn.shtmlhttp://www.securityfocus.com/bid/28464http://www.securitytracker.com/id?1019715http://www.us-cert.gov/cas/techalerts/TA08-087B.htmlhttp://www.vupen.com/english/advisories/2008/1006/referenceshttps://exchange.xforce.ibmcloud.com/vulnerabilities/41468https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5648http://secunia.com/advisories/29507http://www.cisco.com/warp/public/707/cisco-sa-20080326-mvpn.shtmlhttp://www.securityfocus.com/bid/28464http://www.securitytracker.com/id?1019715http://www.us-cert.gov/cas/techalerts/TA08-087B.htmlhttp://www.vupen.com/english/advisories/2008/1006/referenceshttps://exchange.xforce.ibmcloud.com/vulnerabilities/41468https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5648
2008-03-27
Published