PT-2017-17237 · Cisco · Cisco Virtualized Packet Core-Distributed Instance (Vpc-Di)

Published 2017-06-26 · Updated 2019-10-09 · CVE-2017-6678

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco Virtualized Packet Core-Distributed Instance (VPC-DI) Software versions 19.2 through 21.0

Description The issue is related to insufficient handling of user-supplied data in the ingress UDP packet processing functionality. An unauthenticated, remote attacker can cause a denial of service (DoS) condition by sending crafted UDP packets to the distributed instance (DI) network addresses of both control function (CF) instances on an affected system. This can lead to an unhandled error condition, causing the CF instances to reload, which in turn causes the entire VPC to reload, resulting in the disconnection of all subscribers. The vulnerability can be exploited via IPv4 traffic only.

Recommendations For Cisco Virtualized Packet Core-Distributed Instance (VPC-DI) Software versions 19.2 through 21.0, update to a fixed version to resolve the issue. As a temporary workaround, consider restricting access to the affected system's DI network addresses to minimize the risk of exploitation. Avoid sending crafted UDP packets to the affected system until the issue is resolved.

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

CWE-399

Related Identifiers

CVE-2017-6678

Affected Products

Cisco Virtualized Packet Core-Distributed Instance (Vpc-Di)

References · 4

• https://osv.dev/vulnerability/CVE-2017-6678 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-6678 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170621-vpc · Vendor Advisory
• http://securityfocus.com/bid/99195 · Note