CVE-2006-4650

Cisco IOS 12.0, 12.1, and 12.2, when GRE IP tunneling is used and the RFC2784 compliance fixes are missing, does not verify the offset field of a GRE packet…

published September 9, 2006

CVSS
—
EPSS
3%
Percentile
88.2
In the wild
Unconfirmed
What it is

Cisco IOS 12.0, 12.1, and 12.2, when GRE IP tunneling is used and the RFC2784 compliance fixes are missing, does not verify the offset field of a GRE packet during decapsulation, which leads to an integer overflow that references data from incorrect memory locations, which allows remote attackers to inject crafted packets into the routing queue, possibly bypassing intended router ACLs.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03232 · 88.2th percentile
Published
2006-09-09T00:00Z
EPSS history
Timeline
  • 09 SEP 00:00Z
    Cisco IOS 12.0, 12.1, and 12.2, when GRE IP tunneling is used and the RFC2784 compliance fixes are missing, does not verify the offset field of a GRE packet…
    cvelistv5