PT-2017-2989 · Cisco · Cisco Ios Xe

Publicado 2017-09-27 · Atualizado 2019-10-09 · CVE-2017-12236

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco IOS XE versions 3.2 through 16.5

Description A logic error in the implementation of the Locator/ID Separation Protocol (LISP) could allow an unauthenticated, remote attacker to bypass authentication checks when registering an Endpoint Identifier (EID) to a Routing Locator (RLOC) in the map server/map resolver (MS/MR). The vulnerability can be exploited by sending specific valid map-registration requests, which will be accepted by the MS/MR even if the authentication keys do not match. A successful exploit could allow the attacker to inject invalid mappings of EIDs to RLOCs in the MS/MR.

Recommendations For Cisco IOS XE versions 3.2 through 16.5, update to a fixed software release, as Cisco has released software updates that address this vulnerability. At the moment, there is no information about other workarounds that address this vulnerability.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

BDU:2017-02334

CVE-2017-12236

Produtos afetados

Cisco Ios Xe

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2017-12236 · Nota de Segurança
• https://bdu.fstec.ru/vul/2017-02334 · Nota de Segurança
• http://securityfocus.com/bid/101033 · Nota
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-lisp · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-12236 · Aviso do Fabricante
• http://securitytracker.com/id/1039448 · Nota