PT-2017-17237 · Cisco · Cisco Virtualized Packet Core-Distributed Instance (Vpc-Di)

Publicado 2017-06-26 · Atualizado 2019-10-09 · CVE-2017-6678

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco Virtualized Packet Core-Distributed Instance (VPC-DI) Software versions 19.2 through 21.0

Description The issue is related to insufficient handling of user-supplied data in the ingress UDP packet processing functionality. An unauthenticated, remote attacker can cause a denial of service (DoS) condition by sending crafted UDP packets to the distributed instance (DI) network addresses of both control function (CF) instances on an affected system. This can lead to an unhandled error condition, causing the CF instances to reload, which in turn causes the entire VPC to reload, resulting in the disconnection of all subscribers. The vulnerability can be exploited via IPv4 traffic only.

Recommendations For Cisco Virtualized Packet Core-Distributed Instance (VPC-DI) Software versions 19.2 through 21.0, update to a fixed version to resolve the issue. As a temporary workaround, consider restricting access to the affected system's DI network addresses to minimize the risk of exploitation. Avoid sending crafted UDP packets to the affected system until the issue is resolved.

Correção

Improper Handling of Exceptional Conditions

Enumeração de Fraquezas

CWE-755

CWE-399

Identificadores relacionados

CVE-2017-6678

Produtos afetados

Cisco Virtualized Packet Core-Distributed Instance (Vpc-Di)

Referências · 4

• https://osv.dev/vulnerability/CVE-2017-6678 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-6678 · Nota de Segurança
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170621-vpc · Aviso do Fabricante
• http://securityfocus.com/bid/99195 · Nota