Summary

• Cisco released its semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication on September 28, 2016. In direct response to customer feedback, Cisco releases bundles of Cisco IOS Software Security Advisories on the fourth Wednesday of the month in March and September of each calendar year.

  The September 28, 2016, release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication includes 10 Cisco Security Advisories that describe 11 vulnerabilities in Cisco IOS and IOS XE Software. Cisco has confirmed that none of the vulnerabilities exist in Cisco IOS XR Software or Cisco NX-OS Software.

  Seven of the advisories describe vulnerabilities that are common to both Cisco IOS and IOS XE Software. One advisory describes a vulnerability that exists only in Cisco IOS Software. Two other advisories describe vulnerabilities that exist only in Cisco IOS XE Software. All the vulnerabilities have a Security Impact Rating of “High.” Exploits of the individual vulnerabilities could result in a denial of service (DoS) condition or a memory leak.

  To quickly determine if a specific Cisco IOS or IOS XE Software release is exposed to Cisco product vulnerabilities, use the Cisco IOS Software Checker.

Details

• The following table identifies Cisco Security content associated with this Cisco IOS and IOS XE Software Security Advisory Bundled Publication:

  Cisco Security Advisory	CVE ID	Security Impact Rating	CVSS Base Score	IPS Signature	OVAL Definition
  cisco-sa-20160928-cip Cisco IOS Software Common Industrial Protocol Request Denial of Service Vulnerability	CVE-2016-6391	High	7.8	-	cisco-sa-20160928-cip-CVE-2016-6391
  cisco-sa-20160928-aaados Cisco IOS and IOS XE Software AAA Login Denial of Service Vulnerability	CVE-2016-6393	High	7.1	-	cisco-sa-20160928-aaados-CVE-2016-6393
  cisco-sa-20160928-dns Cisco IOS and IOS XE Software DNS Forwarder Denial of Service Vulnerability	CVE-2016-6380	High	8.3	Cisco IOS and IOS-XE Software Domain Name System Memory Corruption	cisco-sa-20160928-dns-CVE-2016-6380
  cisco-sa-20160928-h323 Cisco IOS and IOS XE Software H.323 Message Validation Denial of Service Vulnerability	CVE-2016-6384	High	7.8	-	cisco-sa-20160928-h323-CVE-2016-6384
  cisco-sa-20160928-ios-ikev1 Cisco IOS and IOS XE Software Internet Key Exchange Version 1 Fragmentation Denial of Service Vulnerability	CVE-2016-6381	High	7.1	Cisco IOS and IOS XE Software Internet Key Exchange Fragmentation Denial of Service	cisco-sa-20160928-ios-ikev1-CVE-2016-6381
  cisco-sa-20160928-ipdr Cisco IOS and IOS XE Software IP Detail Record Denial of Service Vulnerability	CVE-2016-6379	High	7.8	Cisco IOS Router Denial of Service	cisco-sa-20160928-ipdr-CVE-2016-6379
  cisco-sa-20160928-msdp Cisco IOS and IOS XE Software Multicast Routing Denial of Service Vulnerabilities	CVE-2016-6382, CVE-2016-6392	High	7.8	-	cisco-sa-20160928-msdp-CVE-2016-6382
  			7.8	-	cisco-sa-20160928-msdp-CVE-2016-6392
  cisco-sa-20160928-smi Cisco IOS and IOS XE Software Smart Install Memory Leak Vulnerability	CVE-2016-6385	High	7.8	-	cisco-sa-20160928-smi-CVE-2016-6385
  cisco-sa-20160928-frag Cisco IOS XE Software IP Fragment Reassembly Denial of Service Vulnerability	CVE-2016-6386	High	7.8	-	-
  cisco-sa-20160928-esp-nat Cisco IOS XE Software NAT Denial of Service Vulnerability	CVE-2016-6378	High	7.8	Cisco IOS XE Software NAT Denial of Service	-

  
  

  Related Resources

  Cisco Security Vulnerability Policy
  MITRE Common Vulnerabilities and Exposures
  Common Vulnerability Scoring System and the Security Impact Rating
  Common Vulnerability Scoring System Q & A
  Cisco IPS Signature Downloads
  Cisco IOS OVAL Content: Frequently Asked Questions