CVE-2009-0628
published 2009-03-27CVE-2009-0628: Memory leak in the SSLVPN feature in Cisco IOS 12.3 through 12.4 allows remote attackers to cause a denial of service (memory consumption and device crash) by…
PriorityP433critical9CVSS 2.0
AVNACLAuNCPIPAC
EPSS
1.93%
77.8th percentile
Memory leak in the SSLVPN feature in Cisco IOS 12.3 through 12.4 allows remote attackers to cause a denial of service (memory consumption and device crash) by disconnecting an SSL session in an abnormal manner, leading to a Transmission Control Block (TCB) leak.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_ios | — | — |
| cisco | cisco_ios | — | — |
| cisco | ios | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-p6q5-7686-4mrq: Memory leak in the SSLVPN feature in Cisco IOS 12
ghsa_unreviewed·2022-05-02
CVE-2009-0628 [HIGH] CWE-200 GHSA-p6q5-7686-4mrq: Memory leak in the SSLVPN feature in Cisco IOS 12
Memory leak in the SSLVPN feature in Cisco IOS 12.3 through 12.4 allows remote attackers to cause a denial of service (memory consumption and device crash) by disconnecting an SSL session in an abnormal manner, leading to a Transmission Control Block (TCB) leak.
Cisco
Cisco IOS Software WebVPN and SSLVPN Vulnerabilities
vendor_cisco
CVE-2009-0628 Cisco IOS Software WebVPN and SSLVPN Vulnerabilities
CVE-2009-0628: Cisco IOS Software WebVPN and SSLVPN Vulnerabilities
Cisco IOS software contains two vulnerabilities within the Cisco IOS WebVPN or Cisco IOS SSLVPN feature (SSLVPN) that can be remotely exploited without authentication to cause a denial of service condition. Both vulnerabilities affect both Cisco IOS WebVPN and Cisco IOS SSLVPN features: Crafted HTTPS packet will crash device. SSLVPN sessions cause a memory leak in the device. Cisco has released software updates that address these vulnerabilities. There are no
CWE: CWE-399, CWE-399
Bug IDs: CSCsl30548, CSCsx15333, CSCsx28406, CSCsl30548, CSCsx15333
No detection rules found.
No public exploits indexed.
http://secunia.com/advisories/34438http://securitytracker.com/id?1021896http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90424.shtmlhttp://www.cisco.com/en/US/products/products_security_advisory09186a0080a90469.shtmlhttp://www.securityfocus.com/bid/34239http://www.vupen.com/english/advisories/2009/0851https://exchange.xforce.ibmcloud.com/vulnerabilities/49427https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12092http://secunia.com/advisories/34438http://securitytracker.com/id?1021896http://www.cisco.com/en/US/products/products_security_advisory09186a0080a90424.shtmlhttp://www.cisco.com/en/US/products/products_security_advisory09186a0080a90469.shtmlhttp://www.securityfocus.com/bid/34239http://www.vupen.com/english/advisories/2009/0851https://exchange.xforce.ibmcloud.com/vulnerabilities/49427https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12092
2009-03-27
Published