Cisco Cisco IOS Software Release 12.4(23)

CSCec12299

Devices running Cisco IOS versions 12.0S, 12.2, 12.3 or 12.4 and configured for Multiprotocol 
Label Switching (MPLS) Virtual Private Networks (VPNs) or VPN Routing and Forwarding Lite 
(VRF Lite) and using Border Gateway Protocol (BGP) between Customer Edge (CE) and Provider 
Edge (PE) devices may permit information to propagate between VPNs.

Workarounds are available to help mitigate this vulnerability. 

This issue is triggered by a logic error when processing extended communities on the PE device. 

This issue cannot be deterministically exploited by an attacker. 

Cisco has released free software updates that address these vulnerabilities. Workarounds that 
mitigate these vulnerabilities are available.

This advisory is posted at 

CSCsb12598

Cisco IOS device may crash while processing malformed Secure Sockets Layer (SSL) packets. In 
order to trigger these vulnerabilities, a malicious client must send malformed packets during the SSL 
protocol exchange with the vulnerable device.

Successful repeated exploitation of any of these vulnerabilities may lead to a sustained 
Denial-of-Service (DoS); however, vulnerabilities are not known to compromise either the 
confidentiality or integrity of the data or the device. These vulnerabilities are not believed to allow 
an attacker will not be able to decrypt any previously encrypted information.

Cisco IOS is affected by the following vulnerabilities:

Processing ClientHello messages, documented as Cisco bug ID CSCsb12598 

Processing ChangeCipherSpec messages, documented as Cisco bug ID CSCsb40304 

Processing Finished messages, documented as Cisco bug ID CSCsd92405

Cisco has made free software available to address these vulnerabilities for affected customers. There 
are workarounds available to mitigate the effects of these vulnerabilities.

This advisory is posted at 

.

Note: Another related advisory has been posted with this advisory. This additional advisory also 
describes a vulnerability related to cryptography that affects Cisco IOS. This related advisory is 
available at the following link: 

A combined software table for Cisco IOS is available to aid customers in choosing a software 
releases that fixes all security vulnerabilities published as of May 22, 2007. This software table is 
available at the following link: 

. 

CSCsd81407

Multiple voice-related vulnerabilities are identified in Cisco IOS software, one of which is also 
shared with Cisco Unified Communications Manager. These vulnerabilities pertain to the following 
protocols or features: