PT-2017-16124 · Cisco · Cisco Netflow Generation Appliance

Published 2017-03-01 · Updated 2019-10-03 · CVE-2017-3826

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco NetFlow Generation Appliance versions prior to 1.1(1a)

Description A vulnerability in the Stream Control Transmission Protocol (SCTP) decoder could allow an unauthenticated, remote attacker to cause the device to hang or unexpectedly reload, resulting in a denial of service (DoS) condition. This issue is due to incomplete validation of SCTP packets being monitored on the NGA data ports. An attacker could exploit this by sending malformed SCTP packets on a network monitored by an NGA data port. The vulnerability does not affect SCTP packets addressed to the IP address of the NGA itself. Exploitation could cause the appliance to become unresponsive or reload, leading to a DoS condition, and may require user interaction to recover the device.

Recommendations For versions prior to 1.1(1a), update the software to version 1.1(1a) or later to resolve the issue. As a temporary workaround, consider restricting access to the NGA data ports to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-399

CWE-20

Related Identifiers

CVE-2017-3826

Affected Products

Cisco Netflow Generation Appliance

References · 5

• https://osv.dev/vulnerability/CVE-2017-3826 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-3826 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170301-nga · Vendor Advisory
• http://securityfocus.com/bid/96509 · Note
• http://securitytracker.com/id/1037938 · Note