CNCVE编号：CNCVE-20020019 CVE编号： 安全级别：低 漏洞中文描述： IOS（Internet Operating System）是广泛用于Cisco路由器的操作系统，由Cisco公司开发和维护。某些版本的IOS在Cisco Express Forwarding（CEF）实现上存在漏洞，可能导致转发数据包信息泄露。当Cisco路由器处于Cisco Express Forwarding（CEF）模式时，如果路由器收到的数据包其IP头里指明的长度大于包的物理长度时，这样的包会被扩展长度到到IP包头指定的值，当扩展之时，用于扩展的数据来自内存中存储的之前转发过的数据，从而导致了信息的泄露。攻击者无法指定所要获取的信息内容，这减少了获取敏感信息的可能性。 漏洞英文描述： IOS is the Internet Operating System, used on Cisco routers. It is distributed and maintained by Cisco. Under some circumstances, Cisco IOS may leak information from previously routed packets that are still in memory. When a packet sent to a router has a MAC layer packet length shorter than that specified in the IP layer length, the packet is padded by the router before being routed. The data used to pad the packet is taken from other packets previously routed that are still in the router's memory. It should be noted that this problem occurs only when Cisco Express Forwarding is enabled. 漏洞参考： http://www.cisco.com/warp/public/707/IOS-CEF-pub.shtml http://www.cisco.com 系统类型： 其他 漏洞类型：设计错误