PT-2018-8623 · Cisco · Cisco Staros+1

Published 2018-02-08 · Updated 2019-10-09 · CVE-2018-0117

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Cisco Virtualized Packet Core-Distributed Instance (VPC-DI) Software versions N4.0 through N5.5 Cisco StarOS operating system versions 19.2 through 21.3

Description: A vulnerability in the ingress packet processing functionality could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition by sending malicious traffic to the internal distributed instance network address. The issue is due to insufficient handling of user-supplied data, which could cause an unhandled error condition, leading to the reload of control function instances and the entire system, resulting in the disconnection of all subscribers.

Recommendations: For Cisco Virtualized Packet Core-Distributed Instance (VPC-DI) Software versions N4.0 through N5.5, update the software to a version that includes the fix for Cisco Bug ID CSCve17656. For Cisco StarOS operating system versions 19.2 through 21.3, ensure the operating system is updated to a version that includes the necessary security patches to mitigate this issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-0117

Affected Products

Cisco Staros

Cisco Virtualized Packet Core-Distributed Instance (Vpc-Di)

References · 4

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-vpcdi · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-0117 · Security Note
• https://osv.dev/vulnerability/CVE-2018-0117 · Vendor Advisory
• http://securityfocus.com/bid/102970 · Note