Summaryinfo

A vulnerability was found in Cisco 3560 Switch up to 12.2.53 and classified as problematic. Affected by this issue is some unknown functionality of the component Network Handler. Such manipulation as part of Vulnerability Scan leads to denial of service. Furthermore, there is an exploit available. There are still doubts about whether this vulnerability truly exists. It is recommended to use an alternative to replace the affected component.

Detailsinfo

A vulnerability was found in Cisco 3560 Switch up to 12.2.53 and classified as critical. Affected by this issue is an unknown code of the component Network Handler. The manipulation as part of a Vulnerability Scan leads to a denial of service vulnerability. Using CWE to declare the problem leads to CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. Impacted is availability.

The weakness was shared 02/27/2013 by BugsNotHugs as Cisco 3560 DoS as not defined mailinglist post (Full-Disclosure). The advisory is shared for download at seclists.org. The public release happened without coordination with the vendor. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are unknown but a public exploit is available.

A public exploit has been developed by BugsNotHugs and been published immediately after the advisory. The exploit is available at seclists.org. It is declared as proof-of-concept. The real existence of this vulnerability is still doubted at the moment.

Addressing this vulnerability is possible by firewalling All Ports. The problem might be mitigated by replacing the product with as an alternative. The best possible mitigation is suggested to be establishing an alternative product.

The vulnerability is also documented in the vulnerability database at OSVDB (90735†). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Cisco

Name

• 3560 Switch

Version

• 12.2.0
• 12.2.1
• 12.2.2
• 12.2.3
• 12.2.4
• 12.2.5
• 12.2.6
• 12.2.7
• 12.2.8
• 12.2.9
• 12.2.10
• 12.2.11
• 12.2.12
• 12.2.13
• 12.2.14
• 12.2.15
• 12.2.16
• 12.2.17
• 12.2.18
• 12.2.19
• 12.2.20
• 12.2.21
• 12.2.22
• 12.2.23
• 12.2.24
• 12.2.25
• 12.2.26
• 12.2.27
• 12.2.28
• 12.2.29
• 12.2.30
• 12.2.31
• 12.2.32
• 12.2.33
• 12.2.34
• 12.2.35
• 12.2.36
• 12.2.37
• 12.2.38
• 12.2.39
• 12.2.40
• 12.2.41
• 12.2.42
• 12.2.43
• 12.2.44
• 12.2.45
• 12.2.46
• 12.2.47
• 12.2.48
• 12.2.49
• 12.2.50
• 12.2.51
• 12.2.52
• 12.2.53

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion