CVE-2015-4324 Memory corruption in n/a

Medium 6.1 Published 19 Aug 2015 Updated 6 Aug 2024

Remote attackers can cause a denial of service on Cisco Nexus devices by sending malformed IGMPv3 packets that trigger a buffer overflow.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2015-4324?

CVE-2015-4324 is a medium-severity memory corruption vulnerability in Cisco Nx-Os, published on 19 Aug 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Buffer overflow in Cisco NX-OS on Nexus 1000V devices for VMware vSphere 7.3(0)ZN(0.81), Nexus 3000 devices 7.3(0)ZN(0.81), Nexus 4000 devices 4.1(2)E1(1c), Nexus 7000 devices 7.2(0)N1(0.1), and Nexus 9000 devices 7.3(0)ZN(0.81) allows remote attackers to cause a denial of service (IGMP process restart) via a malformed IGMPv3 packet that is mishandled during memory allocation, aka Bug IDs CSCuv69713, CSCuv69717, CSCuv69723, CSCuv69732, and CSCuv48908.

Weakness: CWE-119

Which versions are affected by CVE-2015-4324?

It affects 1 product.

Products include Cisco Nx-Os.

How do I fix CVE-2015-4324?

No fix has been published for CVE-2015-4324 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2015-4324 being exploited?

There is no known exploitation of CVE-2015-4324 in the wild and no public exploit code.

All Cisco Nx-Os vulnerabilities

Sources

Also known as GHSA-4mmx-4w74-g4x8.