Buffer overflow in Cisco Ons 15454 System Software

CVE-2014-2141

The session-termination functionality on Cisco ONS 15454 controller cards with software 9.6 and earlier does not initialize an unspecified pointer, which allows remote authenticated users to cause a denial of service (card reset) via crafted session-close actions, aka Bug ID CSCug97416.

Vulnerability class: Buffer Overflow

EPSS: 0.014 (69.5th percentile) — read the EPSS interpretation.

Affected products

Cisco Cisco_ons_15454_system_software — versions 9.0, 9.1, 9.2
Cisco Ons_15454
N/a — versions n/a

Weakness classification (CWE)

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

References

psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)
psirt@cisco.com (x_refsource_CONFIRM, Vendor Advisory)