CVE-2013-5478

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 15.0 through 15.3 Cisco IOS XE versions 3.2 through 3.8

Description A vulnerability in the Resource Reservation Protocol (RSVP) feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger an interface queue wedge on the affected device. The vulnerability is due to improper parsing of UDP RSVP packets. An attacker could exploit this vulnerability by sending UDP port 1698 RSVP packets to the vulnerable device. An exploit could cause Cisco IOS Software and Cisco IOS XE Software to incorrectly process incoming packets, resulting in an interface queue wedge, which can lead to loss of connectivity, loss of routing protocol adjacency, and other denial of service (DoS) conditions.

Recommendations For Cisco IOS versions 15.0 through 15.3, update to a fixed software version to address the vulnerability. For Cisco IOS XE versions 3.2 through 3.8, update to a fixed software version to address the vulnerability. As a temporary workaround, consider restricting access to UDP port 1698 to minimize the risk of exploitation.