Vulnerability in Cisco Adaptive Security Appliance Software
CVE-2006-3906
Internet Key Exchange (IKE) version 1 protocol, as implemented on Cisco IOS, VPN 3000 Concentrators, and PIX firewalls, allows remote attackers to cause a denial of service (resource exhaustion) via a flood of IKE Phase-1 packets that exceed the session expiration rate. NOTE: it has been argued that this is due to a design weakness of the IKE version 1 protocol, in which case other vendors and implementations would also be affected.
Published · last modified .
CVSS v2 metric
CVSS v2 base score 5.0 (Medium). Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.069 (94.0th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 94th percentile — 94.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.069 · newest: 0.069 · change: 0.000
Affected products
- Cisco Adaptive Security Appliance Software — versions 7.0(5), 7.0, 7.0.1.4
- Cisco iOS
- Cisco Pix Asa Ids
- Cisco Pix Firewall — versions 6.3.3_(133), 6.2.3_(110), 6.2.2_.111
- Cisco Pix Firewall 501
- Cisco Pix Firewall 506
- Cisco Pix Firewall 515
- Cisco Pix Firewall 515e
- Cisco Pix Firewall 520
- Cisco Pix Firewall 525
References
- www.nta-monitor.com/posts/2006/07/cisco-concentrator-dos.html
- www.securityfocus.com/bid/19176 (vdb-entry)
- www.securityfocus.com/archive/1/441203/100/0/threaded (mailing-list)
- www.osvdb.org/29068 (vdb-entry)
- archives.neohapsis.com/archives/bugtraq/2006-07/0531.html (mailing-list)
- oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:5299 (signature, vdb-entry)
- securitytracker.com/id (vdb-entry)
- securityreason.com/securityalert/1293 (third-party-advisory)
- www.cisco.com/en/US/tech/tk583/tk372/tsd_technology_security_response09186a0080… (vendor-advisory)
- exchange.xforce.ibmcloud.com/vulnerabilities/27972 (vdb-entry)