Description
Cisco 12000 with IOS 12.0 and line cards based on Engine 2 does not handle the "fragment" keyword in a compiled ACL (Turbo ACL) for packets that are sent to the router, which allows remote attackers to cause a denial of service via a flood of fragments.
References
- M-018 third-party-advisory government-resource
- 20011114 Multiple Vulnerabilities in Access Control List Implementation for Cisco 12000 Series Internet Router vendor-advisory
- 1987 vdb-entry
- cisco-acl-outgoing-fragment(7551) vdb-entry
- 3539 vdb-entry