CVE-2014-3322

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Cisco IOS XR 4.3(.2) and earlier on ASR 9000 devices does not properly perform NetFlow sampling of IP packets, which allows remote attackers to cause a denial of service (chip and card hangs) via malformed (1) IPv4 or (2) IPv6 packets, aka Bug ID CSCuo68417.

Metrics

CVSS 2.0 6.1/10AV:A/AC:L/Au:N/C:N/I:N/A:C

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/60311
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3322Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=35009Vendor Advisory
http://www.securityfocus.com/bid/68833Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1030623Third Party Advisory, VDB Entry
http://secunia.com/advisories/60311
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3322Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=35009Vendor Advisory
http://www.securityfocus.com/bid/68833Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1030623Third Party Advisory, VDB Entry

Timeline

Published: Jul 24, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-33234.0Directory traversal vulnerability in Cisco Unified Contact Center Enterprise allows remote authenticated users to read arbitrary web-root fi CVE-2014-33244.3Multiple cross-site scripting (XSS) vulnerabilities in the login page in the administrative web interface in Cisco TelePresence Server Softw CVE-2014-33254.3Multiple cross-site scripting (XSS) vulnerabilities in Cisco Unified Customer Voice Portal (CVP) allow remote attackers to inject arbitrary CVE-2014-33266.5SQL injection vulnerability in the web framework in Cisco Security Manager 4.5 and 4.6 allows remote authenticated users to execute arbitrar CVE-2014-33277.8The EnergyWise module in Cisco IOS 12.2, 15.0, 15.1, 15.2, and 15.4 and IOS XE 3.2.xXO, 3.3.xSG, 3.4.xSG, and 3.5.xE before 3.5.3E allows re CVE-2014-33285.0The Intercluster Sync Agent Service in Cisco Unified Presence Server allows remote attackers to cause a denial of service via a TCP SYN floo CVE-2014-33294.3Cross-site scripting (XSS) vulnerability in the web-server component in Cisco Prime Data Center Network Manager (DCNM) 6.3(2) and earlier al CVE-2014-33305.0Cisco NX-OS 6.1(2)I2(1) on Nexus 9000 switches does not properly process packet-drop policy checks for logged packets, which allows remote a CVE-2014-33314.3The Session Manager component in Packet Data Network Gateway (aka PGW) in Cisco ASR 5000 Series Software 11.0, 12.0, 12.1, 12.2, 14.0, 15.0,CVE-2014-33324.0Cisco Unified Communications Manager (CM) 8.6(.2) and earlier has an incorrect CLI restrictions setting, which allows remote authenticated u CVE-2014-33339.0The server in Cisco Unity Connection 9.1(1) and 9.1(2) allows remote authenticated users to obtain privileged access by conducting an "HTTP CVE-2014-33354.6Cisco IOS XR 4.3(.2) and earlier on ASR 9000 devices does not properly perform NetFlow sampling of packets with multicast destination MAC ad