CVE-2011-3280 — Missing Release of Memory after Effective Lifetime in Cisco IOS

CWE-3995 documents5 sources
Severity
7.5HIGHNVD
EPSS
0.5%
top 35.94%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco IOSCisco IOS XE
Timeline
PublishedOct 3
Latest updateMay 17

Description

Memory leak in the NAT implementation in Cisco IOS 12.1 through 12.4 and 15.0 through 15.1, and IOS XE 3.1.xSG, allows remote attackers to cause a denial of service (memory consumption or device reload) by sending crafted SIP packets to UDP port 5060, aka Bug ID CSCtj04672.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶NVDcisco/ios187 versions+186
▶NVDcisco/ios_xe3.1.0sg, 3.1.1sg+1

🔴Vulnerability Details

2
GHSA
GHSA-cfx8-4jg2-j2fj: Memory leak in the NAT implementation in Cisco IOS 12↗2022-05-17
▶
CVEList
CVE-2011-3280: Memory leak in the NAT implementation in Cisco IOS 12↗2011-10-03
▶

📋Vendor Advisories

1
Cisco
Cisco IOS Software Network Address Translation Vulnerabilities↗2011-09-28
▶

💬Community

1
HackerOne
UDP port 5060 (SIP) Open↗2016-02-16
▶
CVE-2011-3280 — Cisco IOS vulnerability | cvebase