CVE-2009-0635 — Missing Release of Memory after Effective Lifetime in Cisco IOS

CWE-3994 documents4 sources
Severity
7.1HIGHNVD
EPSS
1.4%
top 19.42%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Cisco IOS
Timeline
PublishedMar 27
Latest updateMay 2

Description

Memory leak in the Cisco Tunneling Control Protocol (cTCP) encapsulation feature in Cisco IOS 12.4, when an Easy VPN (aka EZVPN) server is enabled, allows remote attackers to cause a denial of service (memory consumption and device crash) via a sequence of TCP packets.

CVSS vector

AV:N/AC:M/C:N/I:N/A:CExploitability: 8.6 | Impact: 6.9

Affected Packages1 packages

▶NVDcisco/ios12.4t, 12.4xz, 12.4ya+2

Patches

Patch: www.cisco.com ↗Patch: www.cisco.com ↗Patch: www.cisco.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-jrx8-5mjp-vjpm: Memory leak in the Cisco Tunneling Control Protocol (cTCP) encapsulation feature in Cisco IOS 12↗2022-05-02
▶
CVEList
CVE-2009-0635: Memory leak in the Cisco Tunneling Control Protocol (cTCP) encapsulation feature in Cisco IOS 12↗2009-03-27
▶

📋Vendor Advisories

1
Cisco
Cisco IOS cTCP Denial of Service Vulnerability↗2009-03-25
▶
CVE-2009-0635 — Cisco IOS vulnerability | cvebase