Description
Cisco IOS 12.0, 12.1, and 12.2, when GRE IP tunneling is used and the RFC2784 compliance fixes are missing, does not verify the offset field of a GRE packet during decapsulation, which leads to an integer overflow that references data from incorrect memory locations, which allows remote attackers to inject crafted packets into the routing queue, possibly bypassing intended router ACLs.
References (11)
Core 11
Core References
Third Party Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2006/3502
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://securitytracker.com/id?1016799
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://www.osvdb.org/28590
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/445322/100/0/threaded
Vendor Advisory x_refsource_misc
http://www.phenoelit.de/stuff/CiscoGRE.txt
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/21783
Third Party Advisory third-party-advisory
x_refsource_sreason
http://securityreason.com/securityalert/1526
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/19878
Vendor Advisory vendor-advisory
x_refsource_cisco
http://www.cisco.com/en/US/tech/tk827/tk369/tsd_technology_security_response09186a008072cd7b.html
Third Party Advisory, VDB Entry vdb-entry
signature
x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5713
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/28786
Scores
EPSS
0.0299
EPSS Percentile
85.9%
Details
Status
published
Products (3)
cisco/ios
12.0
cisco/ios
12.1
cisco/ios
12.2
Published
Sep 09, 2006
Tracked Since
Feb 18, 2026