CVE-2013-0149

CWE-20 — Improper Input Validation8 documents7 sources
Severity
5.8MEDIUM
EPSS
0.8%
top 25.63%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Cisco ASA 5500Cisco IOSCisco IOS XE+2 more
Timeline
PublishedAug 5
Latest updateMay 5

Description

The OSPF implementation in Cisco IOS 12.0 through 12.4 and 15.0 through 15.3, IOS-XE 2.x through 3.9.xS, ASA and PIX 7.x through 9.1, FWSM, NX-OS, and StarOS before 14.0.50488 does not properly validate Link State Advertisement (LSA) type 1 packets before performing operations on the LSA database, which allows remote attackers to cause a denial of service (routing disruption) or obtain sensitive packet information via a (1) unicast or (2) multicast packet, aka Bug IDs CSCug34485, CSCug34469, CSC…

CVSS vector

AV:N/AC:M/C:P/I:N/A:PExploitability: 8.6 | Impact: 4.9

Affected Packages5 packages

▶NVDcisco/staros14.0
▶NVDcisco/ios487 versions+486
▶NVDcisco/ios_xe62 versions+61
▶NVDcisco/asa_55008 versions+7
▶NVDcisco/pix_firewall_software6 versions+5

🔴Vulnerability Details

2
GHSA
GHSA-p37g-cwqg-c54c: The OSPF implementation in Cisco IOS 12↗2022-05-05
▶
CVEList
CVE-2013-0149: The OSPF implementation in Cisco IOS 12↗2013-08-03
▶

📋Vendor Advisories

3
Juniper
CVE-2013-7313: The OSPF implementation in Juniper Junos through 13.x, JunosE, and ScreenOS through 6.3.x does not consider the possibility of duplicate Link State ID↗2014-01-23
▶
Cisco
OSPF LSA Manipulation Vulnerability in Multiple Cisco Products↗2013-08-01
▶
Red Hat
(ospfd): Possibility to use invalid / duplicate LSA information (VU#229804)↗2013-08-01
▶

💬Community

2
Bugzilla
CVE-2013-0149 quagga (ospfd): Possibility to use invalid / duplicate LSA information (VU#229804)↗2013-08-02
▶
Bugzilla
CVE-2013-0630 flash-plugin: buffer overflow flaw that can lead to arbitrary code execution (APSB13-01)↗2013-01-08
▶