PT-2017-12452 · Cisco · Cisco Wireless Lan Controllers+1

Published 2017-11-01 · Updated 2019-10-09 · CVE-2017-12278

Positive Technologies (AI Summary)

CVSS v2.0

5.2

Medium

Base vector

AV:A/AC:M/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco Wireless LAN Controllers (affected versions not specified)

Description A memory leak in the Simple Network Management Protocol (SNMP) subsystem could allow an authenticated, remote attacker to cause an affected device to restart, resulting in a denial of service (DoS) condition. This occurs when an attacker repeatedly polls certain MIB object IDs (OIDs) using the SNMP Version 2 SNMP Read string or valid SNMP Version 3 credentials, consuming available memory on the device.

Recommendations For all affected versions, update to the latest software version that addresses this issue, as released by Cisco. At the moment, there is no information about specific versions that contain a fix for this vulnerability.

Fix

DoS

Buffer Overflow

Missing Release of Resource after Effective Lifetime

Weakness Enumeration

CWE-119

CWE-772

Related Identifiers

CVE-2017-12278

Affected Products

Cisco Wireless Lan Controllers

Cisco Wls

References · 6

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171101-wlc1 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171101-wlc1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-12278 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12278 · Security Note
• http://securitytracker.com/id/1039712 · Note
• http://securityfocus.com/bid/101642 · Note