PT-2017-1792 · Cisco+1 · Cisco Ios Xr+1

Publicado 2017-04-05 · Atualizado 2019-10-03 · CVE-2017-6599

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Cisco IOS XR Software versions 6.1.1.BASE through 6.2.1.BASE

Description A vulnerability in Google-defined remote procedure call (gRPC) handling could allow an unauthenticated, remote attacker to cause the Event Management Service daemon (emsd) to crash due to a system memory leak, resulting in a denial of service (DoS) condition. The vulnerability is due to improper handling of gRPC requests. An attacker could exploit this vulnerability by sending malformed gRPC requests repeatedly to the affected device.

Recommendations For versions 6.1.1.BASE through 6.2.1.BASE, update to a fixed release such as 6.2.1.22i.MGBL, 6.1.22.9i.MGBL, 6.1.21.12i.MGBL, or 6.1.2.13i.MGBL to resolve the issue. As a temporary workaround, consider restricting access to the gRPC service to minimize the risk of exploitation.

Correção

DoS

Missing Release of Resource after Effective Lifetime

Enumeração de Fraquezas

CWE-772

CWE-399

Identificadores relacionados

BDU:2017-00948

CVE-2017-6599

Produtos afetados

Cisco Ios Xr

Grpc

Referências · 6

• http://securityfocus.com/bid/97464 · Nota
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170405-ios · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2017-00948 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-6599 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-6599 · Nota de Segurança
• http://securitytracker.com/id/1038191 · Nota