PT-2018-1452 · Cisco · Cisco Ios Xe+1

Publicado 2018-08-13 · Atualizado 2019-10-09 · CVE-2018-0131

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco IOS and Cisco IOS XE (affected versions not specified)

Description The issue is related to errors in decrypting traffic in the implementation of the Internet Key Exchange (IKE) protocol in Cisco IOS and Cisco IOS XE. This could allow a remote attacker to obtain session keys and decrypt traffic by sending specially crafted data packets to the device. The vulnerability exists because the affected software responds incorrectly to decryption failures, allowing an attacker to exploit this by sending crafted ciphertexts to a device configured with IKEv1 that uses RSA-encrypted nonces. A successful exploit could allow the attacker to obtain the encrypted nonces.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Inadequate Encryption Strength

Enumeração de Fraquezas

CWE-326

Identificadores relacionados

BDU:2018-01003

CVE-2018-0131

Produtos afetados

Cisco Ios

Cisco Ios Xe

Referências · 9

• https://osv.dev/vulnerability/CVE-2018-0131 · Aviso do Fabricante
• https://securitylab.ru/news/495058.php · Nota
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180813-rsa-nonce · Aviso do Fabricante
• https://news.rambler.ru/internet/40559928-issledovateli-obnaruzhili-opasnye-uyazvimosti-v-protokole-ike · Nota
• https://bdu.fstec.ru/vul/2018-01003 · Nota de Segurança
• http://securityfocus.com/bid/105074 · Nota
• https://threatpost.ru/ike-bug-allows-authentication-bypass/27760 · Nota
• http://securitytracker.com/id/1041539 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-0131 · Nota de Segurança