Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2014-3276

Cisco Identity Services Engine (ISE) 1.2(.1 patch 2) and earlier does not properly handle deadlock conditions during reception of crafted RADIUS accounting packets from multiple NAS devices, which allows remote authenticated users to cause a denial of service (RADIUS outage) by sourcing these packets from two origins, aka Bug ID CSCuo56780.

Published

2014-05-26T00:25:31.470

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 4.0 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:N/I:N/A:P

Access Vector: NETWORK
Access Complexity: LOW
Authentication: SINGLE
Confidentiality Impact: NONE
Integrity Impact: NONE
Availability Impact: PARTIAL

Exploitability Score

8.0

Impact Score

2.9

Weaknesses

Type: Primary
CWE-399

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	cisco	identity_services_engine_software	≤ 1.2	Yes
Application	cisco	identity_services_engine_software	1.0	Yes
Application	cisco	identity_services_engine_software	1.1	Yes

References

http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3276 Vendor Advisory ([email protected])
http://tools.cisco.com/security/center/viewAlert.x?alertId=34329 Vendor Advisory ([email protected])
http://www.securitytracker.com/id/1030274 Third Party Advisory, VDB Entry ([email protected])
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3276 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://tools.cisco.com/security/center/viewAlert.x?alertId=34329 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.securitytracker.com/id/1030274 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)