CVE-2013-5472

Published: Sep 27, 2013Modified: Apr 29, 2026

7.1

Vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Exploitability: 8.6 / Impact: 6.9

Source: NVD

Description

The NTP implementation in Cisco IOS 12.0 through 12.4 and 15.0 through 15.1, and IOS XE 2.1 through 3.3, does not properly handle encapsulation of multicast NTP packets within MSDP SA messages, which allows remote attackers to cause a denial of service (device reload) by leveraging an MSDP peer relationship, aka Bug ID CSCuc81226.

Affected (47)

Products: Cisco: Ios Xe, Ios

Cisco

2 products

Ios Xe

Ios

Configuration A

40 vulnerable

Vulnerable Software	Affected Versions
Cisco Ios Xe	Version 2.1.0
Cisco Ios Xe	Version 2.1.1
Cisco Ios Xe	Version 2.1.2
Cisco Ios Xe	Version 2.2.1
Cisco Ios Xe	Version 2.2.2
Cisco Ios Xe	Version 2.2.3
Cisco Ios Xe	Version 2.3.0
Cisco Ios Xe	Version 2.3.1
Cisco Ios Xe	Version 2.3.1t
Cisco Ios Xe	Version 2.3.2
Cisco Ios Xe	Version 2.4.0
Cisco Ios Xe	Version 2.4.1
Cisco Ios Xe	Version 2.4.2
Cisco Ios Xe	Version 2.4.3
Cisco Ios Xe	Version 2.4.4
Cisco Ios Xe	Version 2.5.0
Cisco Ios Xe	Version 2.5.1
Cisco Ios Xe	Version 2.5.2
Cisco Ios Xe	Version 2.6.0
Cisco Ios Xe	Version 2.6.1
Cisco Ios Xe	Version 2.6.2
Cisco Ios Xe	Version 3.1.0s
Cisco Ios Xe	Version 3.1.0sg
Cisco Ios Xe	Version 3.1.1s
Cisco Ios Xe	Version 3.1.1sg
Cisco Ios Xe	Version 3.1.2s
Cisco Ios Xe	Version 3.1.3s
Cisco Ios Xe	Version 3.1.4s
Cisco Ios Xe	Version 3.2.00.xo.15.0(2)xo
Cisco Ios Xe	Version 3.2.0s
Cisco Ios Xe	Version 3.2.0sg
Cisco Ios Xe	Version 3.2.0xo
Cisco Ios Xe	Version 3.2.1s
Cisco Ios Xe	Version 3.2.1sg
Cisco Ios Xe	Version 3.2.2s
Cisco Ios Xe	Version 3.2.2sg
Cisco Ios Xe	Version 3.2.3sg
Cisco Ios Xe	Version 3.2.4sg
Cisco Ios Xe	Version 3.3.0s
Cisco Ios Xe	Version 3.3.0sg

Configuration B

7 vulnerable

Vulnerable Software	Affected Versions
Cisco Ios	Version 12.0
Cisco Ios	Version 12.1
Cisco Ios	Version 12.2
Cisco Ios	Version 12.3
Cisco Ios	Version 12.4
Cisco Ios	Version 15.0
Cisco Ios	Version 15.1

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (2)

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130925-ntp

Source: psirt@cisco.com

Vendor Advisory

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130925-ntp

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.