CVE-2020-3409
published 2020-09-24CVE-2020-3409: A vulnerability in the PROFINET feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause an affected…
PriorityP335high7.4CVSS 3.1
AVAACLPRNUINSCCNINAH
EPSS
0.53%
41.8th percentile
A vulnerability in the PROFINET feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause an affected device to crash and reload, resulting in a denial of service (DoS) condition on the device. The vulnerability is due to insufficient processing logic for crafted PROFINET packets that are sent to an affected device. An attacker could exploit this vulnerability by sending crafted PROFINET packets to an affected device for processing. A successful exploit could allow the attacker to cause the device to crash and reload, resulting in a DoS condition on the device.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_ios | — | — |
| cisco | ios | — | — |
| cisco | ios | — | — |
| cisco | ios_and_ios_xe | — | — |
| cisco | ios_xe | — | — |
| cisco | ios_xe | — | — |
| msrc | qemu-img-4.2.0-29.cm1.aarch64.rpm_on_cbl_mariner_1.0_arm | — | — |
| msrc | qemu-img-4.2.0-29.cm1.x86_64.rpm_on_cbl_mariner_1.0_x64 | — | — |
| msrc | qemu-kvm-4.2.0-29.cm1.aarch64.rpm_on_cbl_mariner_1.0_arm | — | — |
| msrc | qemu-kvm-4.2.0-29.cm1.x86_64.rpm_on_cbl_mariner_1.0_x64 | — | — |
CVSS provenance
nvdv3.17.4HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
nvdv3.07.4HIGHCVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
nvdv2.06.1MEDIUMAV:A/AC:L/Au:N/C:N/I:N/A:C
vendor_cisco7.4HIGH
vendor_redhat6.3MEDIUM
vendor_msrc5.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective thus making QEMU vulnerable to the out-of-bounds read/write access issues previously found in the SDHCI controller emulation cod
vendor_msrc·2021-03-09·CVSS 5.7
CVE-2021-3409 [MEDIUM] CWE-119 The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective thus making QEMU vulnerable to the out-of-bounds read/write access issues previously found in the SDHCI controller emulation cod
The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective thus making QEMU vulnerable to the out-of-bounds read/write access issues previously found in the SDHCI controller emulation code. This flaw allows a malicious privileged guest to crash the QEMU process on the host resulting in a denial of service or potential code execution. QEMU up to (including) 5.2.0 is affected by this.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committ
Red Hat
QEMU: sdhci: incomplete fix for CVE-2020-17380/CVE-2020-25085
vendor_redhat·2020-12-28·CVSS 6.3
CVE-2021-3409 [MEDIUM] CWE-119 QEMU: sdhci: incomplete fix for CVE-2020-17380/CVE-2020-25085
QEMU: sdhci: incomplete fix for CVE-2020-17380/CVE-2020-25085
The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU vulnerable to the out-of-bounds read/write access issues previously found in the SDHCI controller emulation code. This flaw allows a malicious privileged guest to crash the QEMU process on the host, resulting in a denial of service or potential code execution. QEMU up to (including) 5.2.0 is affected by this.
The patch for CVE-2020-17380 and CVE-2020-25085, both involving a heap buffer overflow in the SDHCI controller emulation code of QEMU, was found to be incomplete. A malicious privileged guest could reproduce the same issues with specially crafted input, inducing a bogus transfer and subsequent out-of-bounds read/write access in sdhci
Cisco
Cisco IOS and IOS XE Software PROFINET Denial of Service Vulnerability
vendor_cisco·2020-09-24·CVSS 7.4
CVE-2020-3409 [HIGH] CWE-20 Cisco IOS and IOS XE Software PROFINET Denial of Service Vulnerability
Cisco IOS and IOS XE Software PROFINET Denial of Service Vulnerability
A vulnerability in the PROFINET feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause an affected device to crash and reload, resulting in a denial of service (DoS) condition on the device.
The vulnerability is due to insufficient processing logic for crafted PROFINET packets that are sent to an affected device. An attacker could exploit this vulnerability by sending crafted PROFINET packets to an affected device for processing. A successful exploit could allow the attacker to cause the device to crash and reload, resulting in a DoS condition on the device.
Cisco has released software updates that address this vulnerability. There are no workarounds that add
Cisco
Cisco IOS and IOS XE Software PROFINET Denial of Service Vulnerability
vendor_cisco·CVSS 3.0
CVE-2020-3409 Cisco IOS and IOS XE Software PROFINET Denial of Service Vulnerability
CVE-2020-3409: Cisco IOS and IOS XE Software PROFINET Denial of Service Vulnerability
A vulnerability in the PROFINET feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause an affected device to crash and reload, resulting in a denial of service (DoS) condition on the device. The vulnerability is due to insufficient processing logic for crafted PROFINET packets that are sent to an affected device. An attacker could exploit this vulnerability by sending crafted PROFINET packets to an affected device for processing. A successful exploit could allow the attacker to cause the device to crash and reload, resulting in a DoS condition on the device. Cisco has released software updates that address this vulnerability. There are no
CVSS: 3
GHSA
GHSA-v4cp-84g9-jwmp: A vulnerability in the PROFINET feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause an
ghsa_unreviewed·2022-05-24
CVE-2020-3409 [HIGH] CWE-400 GHSA-v4cp-84g9-jwmp: A vulnerability in the PROFINET feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause an
A vulnerability in the PROFINET feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause an affected device to crash and reload, resulting in a denial of service (DoS) condition on the device. The vulnerability is due to insufficient processing logic for crafted PROFINET packets that are sent to an affected device. An attacker could exploit this vulnerability by sending crafted PROFINET packets to an affected device for processing. A successful exploit could allow the attacker to cause the device to crash and reload, resulting in a DoS condition on the device.
Suricata
ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id INSERT
suricata·2010-07-30·CVSS 7.5
CVE-2007-1297 [HIGH] ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id INSERT
ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id INSERT
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id INSERT"; flow:established,to_server; http.uri; content:"/view_profile.php?"; nocase; content:"user_id="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:1; reference:cve,CVE-2007-1297; reference:url,www.milw0rm.com/exploits/3409; classtype:web-application-attack; sid:2004537; rev:11; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_13, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access
Suricata
ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id DELETE
suricata·2010-07-30·CVSS 7.5
CVE-2007-1297 [HIGH] ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id DELETE
ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id DELETE
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id DELETE"; flow:established,to_server; http.uri; content:"/view_profile.php?"; nocase; content:"user_id="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:1; reference:cve,CVE-2007-1297; reference:url,www.milw0rm.com/exploits/3409; classtype:web-application-attack; sid:2004538; rev:11; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_13, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access
Suricata
ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id UPDATE
suricata·2010-07-30·CVSS 7.5
CVE-2007-1297 [HIGH] ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id UPDATE
ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id UPDATE
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id UPDATE"; flow:established,to_server; http.uri; content:"/view_profile.php?"; nocase; content:"user_id="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:1; reference:cve,CVE-2007-1297; reference:url,www.milw0rm.com/exploits/3409; classtype:web-application-attack; sid:2004540; rev:11; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_13, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access,
Suricata
ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id UNION SELECT
suricata·2010-07-30·CVSS 7.5
CVE-2007-1297 [HIGH] ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id UNION SELECT
ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id UNION SELECT
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id UNION SELECT"; flow:established,to_server; http.uri; content:"/view_profile.php?"; nocase; content:"user_id="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:1; pcre:"/UNION\s+?SELECT/i"; reference:cve,CVE-2007-1297; reference:url,www.milw0rm.com/exploits/3409; classtype:web-application-attack; sid:2004536; rev:11; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_13, mitre_tactic_id
Suricata
ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id ASCII
suricata·2010-07-30·CVSS 7.5
CVE-2007-1297 [HIGH] ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id ASCII
ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id ASCII
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id ASCII"; flow:established,to_server; http.uri; content:"/view_profile.php?"; nocase; content:"user_id="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:1; reference:cve,CVE-2007-1297; reference:url,www.milw0rm.com/exploits/3409; classtype:web-application-attack; sid:2004539; rev:11; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_13, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access
Suricata
ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id SELECT
suricata·2010-07-30·CVSS 7.5
CVE-2007-1297 [HIGH] ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id SELECT
ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id SELECT
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS AJDating SQL Injection Attempt -- view_profile.php user_id SELECT"; flow:established,to_server; http.uri; content:"/view_profile.php?"; nocase; content:"user_id="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:1; reference:cve,CVE-2007-1297; reference:url,www.milw0rm.com/exploits/3409; classtype:web-application-attack; sid:2004535; rev:11; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_13, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access
No public exploits indexed.
No writeups or analysis indexed.
2020-09-24
Published