PT-2018-8848 · Cisco · Cisco Ios Xe

Publicado 2018-09-26 · Atualizado 2020-12-07 · CVE-2018-0471

Positive Technologies (AI Summary)

CVSS v3.1

7.4

Alta

Vetor base

AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software versions 16.6.1 through 16.6.2

Description A vulnerability in the Cisco Discovery Protocol (CDP) module could allow an unauthenticated, adjacent attacker to cause a memory leak that may lead to a denial of service (DoS) condition. The vulnerability is due to incorrect processing of certain CDP packets. An attacker could exploit this vulnerability by sending certain CDP packets to an affected device. A successful exploit could cause an affected device to continuously consume memory and eventually result in a memory allocation failure that leads to a crash, triggering a reload of the affected device.

Recommendations For Cisco IOS XE Software versions 16.6.1 and 16.6.2, update to a newer version that includes the software updates released by Cisco to address this vulnerability. At the moment, there is no information about a specific newer version that contains a fix for this vulnerability.

Correção

DoS

Resource Exhaustion

Missing Release of Resource after Effective Lifetime

Enumeração de Fraquezas

CWE-400

CWE-772

Identificadores relacionados

CVE-2018-0471

Produtos afetados

Cisco Ios Xe

Referências · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-cdp-memleak · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-0471 · Nota de Segurança
• http://securityfocus.com/bid/105398 · Nota
• https://osv.dev/vulnerability/CVE-2018-0471 · Aviso do Fabricante
• http://securitytracker.com/id/1041737 · Nota