CVE-2019-16019 (CNNVD-202002-303)
中文标题:
Cisco IOS XR 资源管理错误漏洞
英文标题:
Cisco IOS XR Software BGP EVPN Denial of Service Vulnerabilities
漏洞描述
中文描述:
Cisco IOS XR是美国思科（Cisco）公司的一套为其网络设备开发的操作系统。 Cisco IOS XR 6.6.1之后版本中边界网关协议（BGP）以太网VPN（EVPN）功能的实现存在资源管理错误漏洞，该漏洞源于程序没有正确处理包含有特制EVPN属性的BGP更新消息。攻击者可通过发送属性格式错误的BGP EVPN更新消息利用该漏洞造成BGP进程意外重新启动，从而导致拒绝服务。
英文描述:
Multiple vulnerabilities in the implementation of Border Gateway Protocol (BGP) Ethernet VPN (EVPN) functionality in Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerabilities are due to incorrect processing of BGP update messages that contain crafted EVPN attributes. An attacker could exploit these vulnerabilities by sending BGP EVPN update messages with malformed attributes to be processed by an affected system. A successful exploit could allow the attacker to cause the BGP process to restart unexpectedly, resulting in a DoS condition. The Cisco implementation of BGP accepts incoming BGP traffic only from explicitly defined peers. To exploit these vulnerabilities, the malicious BGP update message would need to come from a configured, valid BGP peer, or would need to be injected by the attacker into the victim's BGP network on an existing, valid TCP connection to a BGP peer.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| Cisco | Cisco IOS XR Software | n/a | - | - |
cpe:2.3:a:cisco:cisco_ios_xr_software:n_a:*:*:*:*:*:*:*
|
| cisco | ios_xr | 6.6.1 | - | - |
cpe:2.3:o:cisco:ios_xr:6.6.1:*:*:*:*:*:*:*
|
| cisco | ios_xr | 6.6.2 | - | - |
cpe:2.3:o:cisco:ios_xr:6.6.2:*:*:*:*:*:*:*
|
| cisco | ios_xr | 6.6.25 | - | - |
cpe:2.3:o:cisco:ios_xr:6.6.25:*:*:*:*:*:*:*
|
| cisco | ios_xr | 7.0.1 | - | - |
cpe:2.3:o:cisco:ios_xr:7.0.1:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
参考链接
cve.org
CVSS评分详情
3.0 (cna)
HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2019-16019 |
2025-11-11 15:20:04 | 2025-11-11 07:35:36 |
| NVD | nvd_CVE-2019-16019 |
2025-11-11 14:56:33 | 2025-11-11 07:44:08 |
| CNNVD | cnnvd_CNNVD-202002-303 |
2025-11-11 15:10:22 | 2025-11-11 07:55:34 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 资源管理错误
- cnnvd_id: 未提取 -> CNNVD-202002-303
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- affected_products_count: 1 -> 5
- data_sources: ['cve'] -> ['cve', 'nvd']