Lucene search

[email protected]CVE-2018-0165

HistoryMar 28, 2018 - 10:29 p.m.

CVE-2018-0165

2018-03-2822:29:00

CWE-399

CWE-772

[email protected]

web.nvd.nist.gov

cisco

ios xe

vulnerability

igmp

denial of service

dos

memory leak

nvd

cve-2018-0165

security advisory

buffer exhaustion

6.1 Medium

CVSS2

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:A/AC:L/Au:N/C:N/I:N/A:C

7.4 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

7.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

42.1%

JSON

A vulnerability in the Internet Group Management Protocol (IGMP) packet-processing functionality of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to exhaust buffers on an affected device, resulting in a denial of service (DoS) condition, aka a Memory Leak. The vulnerability is due to the affected software insufficiently processing IGMP Membership Query packets that are sent to an affected device. An attacker could exploit this vulnerability by sending a large number of IGMP Membership Query packets, which contain certain values, to an affected device. A successful exploit could allow the attacker to exhaust buffers on the affected device, resulting in a DoS condition that requires the device to be reloaded manually. This vulnerability affects: Cisco Catalyst 4500 Switches with Supervisor Engine 8-E, if they are running Cisco IOS XE Software Release 3.x.x.E and IP multicast routing is configured; Cisco devices that are running Cisco IOS XE Software Release 16.x, if IP multicast routing is configured. Cisco Bug IDs: CSCuw09295, CSCve94496.

Affected configurations

NVD

Node

ciscoios_xeMatch15.2\(3\)e

AND

ciscocatalyst_4000Match-

Node

ciscoios_xeMatchdenali-16.3.3

AND

ciscocatalyst_3850-12s-eMatch-

ciscocatalyst_3850-12s-sMatch-

ciscocatalyst_3850-12xs-eMatch-

ciscocatalyst_3850-12xs-sMatch-

ciscocatalyst_3850-16xs-eMatch-

ciscocatalyst_3850-16xs-sMatch-

ciscocatalyst_3850-24p-eMatch-

ciscocatalyst_3850-24p-lMatch-

ciscocatalyst_3850-24p-sMatch-

ciscocatalyst_3850-24pw-sMatch-

ciscocatalyst_3850-24s-eMatch-

ciscocatalyst_3850-24s-sMatch-

ciscocatalyst_3850-24t-eMatch-

ciscocatalyst_3850-24t-lMatch-

ciscocatalyst_3850-24t-sMatch-

ciscocatalyst_3850-24u-eMatch-

ciscocatalyst_3850-24u-lMatch-

ciscocatalyst_3850-24u-sMatch-

ciscocatalyst_3850-24xs-eMatch-

ciscocatalyst_3850-24xs-sMatch-

ciscocatalyst_3850-24xu-eMatch-

ciscocatalyst_3850-24xu-lMatch-

ciscocatalyst_3850-24xu-sMatch-

ciscocatalyst_3850-32xs-eMatch-

ciscocatalyst_3850-32xs-sMatch-

ciscocatalyst_3850-48f-eMatch-

ciscocatalyst_3850-48f-lMatch-

ciscocatalyst_3850-48f-sMatch-

ciscocatalyst_3850-48p-eMatch-

ciscocatalyst_3850-48p-lMatch-

ciscocatalyst_3850-48p-sMatch-

ciscocatalyst_3850-48pw-sMatch-

ciscocatalyst_3850-48t-eMatch-

ciscocatalyst_3850-48t-lMatch-

ciscocatalyst_3850-48t-sMatch-

ciscocatalyst_3850-48u-eMatch-

ciscocatalyst_3850-48u-lMatch-

ciscocatalyst_3850-48u-sMatch-

ciscocatalyst_3850-48xs-eMatch-

ciscocatalyst_3850-48xs-f-eMatch-

ciscocatalyst_3850-48xs-f-sMatch-

ciscocatalyst_3850-48xs-sMatch-

ciscocatalyst_c3850-12x48u-eMatch-

ciscocatalyst_c3850-12x48u-lMatch-

ciscocatalyst_c3850-12x48u-sMatch-

CPENameOperatorVersion
cisco:ios_xecisco ios xeeq15.2\(3\)e

CPE	Name	Operator	Version
cisco:ios_xe	cisco ios xe	eq	15.2\(3\)e

CNA Affected

[
  {
    "product": "Cisco IOS XE",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Cisco IOS XE"
      }
    ]
  }
]

References

www.securityfocus.com/bid/103568

www.securitytracker.com/id/1040592

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-igmp

Social References

6.1 Medium

CVSS2

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:A/AC:L/Au:N/C:N/I:N/A:C

7.4 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

7.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

42.1%

JSON

Related for CVE-2018-0165

nvd1 nessus1 prion1 cvelist1 cisco1