PT-2017-12407 · Cisco · Cisco Asr 5500

Published 2017-09-07 · Updated 2019-10-09 · CVE-2017-12217

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Cisco ASR 5500 System Architecture Evolution (SAE) Gateways (affected versions not specified)

Description A vulnerability in the General Packet Radio Service (GPRS) Tunneling Protocol ingress packet handler could allow an unauthenticated, remote attacker to cause a partial denial of service (DoS) condition on an affected device. The issue is due to improper input validation of GPRS Tunneling Protocol packet headers. An attacker could exploit this by sending a malformed GPRS Tunneling Protocol packet, causing the GTPUMGR process to restart unexpectedly. This could result in a brief impact on traffic passing through the device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2017-12217

Affected Products

Cisco Asr 5500

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-12217 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-asr · Vendor Advisory
• http://securityfocus.com/bid/100642 · Note
• http://securitytracker.com/id/1039276 · Note