SB2012032902 - Multiple vulnerabilities in Nextcloud ios

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2012032902

SB2012032902 - Multiple vulnerabilities in Nextcloud ios

Published: March 29, 2012 Updated: December 20, 2022

Security Bulletin ID SB2012032902
Severity
Medium
Patch available
YES
Number of vulnerabilities 16
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 81% Low 19%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 16 secuirty vulnerabilities.


1) Buffer overflow (CVE-ID: CVE-2012-3915)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The DMVPN tunnel implementation in Cisco IOS 15.2 allows remote attackers to cause a denial of service (persistent IKE state) via a large volume of hub-to-spoke traffic, aka Bug ID CSCtq39602.


2) Input validation error (CVE-ID: CVE-2012-3923)

The vulnerability allows a remote #AU# to perform service disruption.

The SSLVPN implementation in Cisco IOS 12.4, 15.0, 15.1, and 15.2, when DTLS is not enabled, does not properly handle certain outbound ACL configurations, which allows remote authenticated users to cause a denial of service (device crash) via a session involving a PPP over ATM (PPPoA) interface, aka Bug ID CSCte41827.


3) Input validation error (CVE-ID: CVE-2012-3924)

The vulnerability allows a remote #AU# to perform service disruption.

The SSLVPN implementation in Cisco IOS 15.1 and 15.2, when DTLS is enabled, does not properly handle certain outbound ACL configurations, which allows remote authenticated users to cause a denial of service (device crash) via a session involving a PPP over ATM (PPPoA) interface, aka Bug ID CSCty97961.


4) Information disclosure (CVE-ID: CVE-2012-1361)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

Cisco IOS 15.1 and 15.2, when the Multicast Music-on-Hold (MMoH) feature of Cisco Unified Communications Manager (CUCM) is enabled, allows remote attackers to obtain sensitive crosstalk information by listening during a PSTN call, aka Bug ID CSCtx77750.


5) Buffer overflow (CVE-ID: CVE-2012-1344)

The vulnerability allows a remote #AU# to perform service disruption.

Cisco IOS 15.1 and 15.2, when a clientless SSL VPN is configured, allows remote authenticated users to cause a denial of service (device reload) by using a web browser to refresh the SSL VPN portal page, as demonstrated by the Android browser, aka Bug ID CSCtr86328.


6) Input validation error (CVE-ID: CVE-2012-1367)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The MallocLite implementation in Cisco IOS 12.0, 12.2, 15.0, 15.1, and 15.2 allows remote attackers to cause a denial of service (Route Processor crash) via a BGP UPDATE message with a modified local-preference (aka LOCAL_PREF) attribute length, aka Bug ID CSCtq06538.


7) Race condition (CVE-ID: CVE-2012-1324)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

Race condition in the Zone-Based Firewall in Cisco IOS 15.1 and 15.2, when IPS policies are configured, allows remote attackers to cause a denial of service (device crash) by sending IPv6 packets, aka Bug ID CSCtk53534.


8) Memory leak (CVE-ID: CVE-2011-2578)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within Cisco IOS 15.1 and 15.2 allows remote attackers to cause a denial of service (memory consumption) via malformed SIP packets on a NAT interface, aka Bug ID CSCts12366. A remote attacker can perform a denial of service attack.


9) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2011-3289)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Cisco IOS 12.4 and 15.0 through 15.2 allows physically proximate attackers to bypass the No Service Password-Recovery feature and read the start-up configuration via unspecified vectors, aka Bug ID CSCtr97640.


10) Input validation error (CVE-ID: CVE-2011-4016)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The PPP implementation in Cisco IOS 12.2 and 15.0 through 15.2, when Point-to-Point Termination and Aggregation (PTA) and L2TP are used, allows remote attackers to cause a denial of service (device crash) via crafted network traffic, aka Bug ID CSCtf71673.


11) Memory leak (CVE-ID: CVE-2012-0387)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the HTTP Inspection Engine feature in the Zone-Based Firewall in Cisco IOS 12.4, 15.0, 15.1, and 15.2 allows remote attackers to cause a denial of service (memory consumption or device reload) via crafted transit HTTP traffic, aka Bug ID CSCtq36153. A remote attacker can perform a denial of service attack.


12) Memory leak (CVE-ID: CVE-2012-0388)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the H.323 inspection feature in the Zone-Based Firewall in Cisco IOS 12.4, 15.0, 15.1, and 15.2 allows remote attackers to cause a denial of service (memory consumption or device reload) via malformed transit H.323 traffic, aka Bug ID CSCtq45553. A remote attacker can perform a denial of service attack.


13) Memory leak (CVE-ID: CVE-2012-1310)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the Zone-Based Firewall in Cisco IOS 12.4, 15.0, 15.1, and 15.2 allows remote attackers to cause a denial of service (memory consumption or device reload) via crafted IP packets, aka Bug ID CSCto89536. A remote attacker can perform a denial of service attack.


14) Resource management error (CVE-ID: CVE-2012-1312)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The MACE feature in Cisco IOS 15.1 and 15.2 allows remote attackers to cause a denial of service (device reload) via crafted transit traffic, aka Bug IDs CSCtq64987 and CSCtu57226.


15) Resource management error (CVE-ID: CVE-2012-1314)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The WAAS Express feature in Cisco IOS 15.1 and 15.2 allows remote attackers to cause a denial of service (memory consumption or device reload) via crafted transit traffic, aka Bug ID CSCtt45381.


16) Memory leak (CVE-ID: CVE-2012-1315)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the SIP inspection feature in the Zone-Based Firewall in Cisco IOS 12.4, 15.0, 15.1, and 15.2 allows remote attackers to cause a denial of service (memory consumption or device reload) via crafted transit SIP traffic, aka Bug ID CSCti46171. A remote attacker can perform a denial of service attack.


Remediation

Install update from vendor's website.

References