PT-2018-8848 · Cisco · Cisco Ios Xe

Published 2018-09-26 · Updated 2020-12-07 · CVE-2018-0471

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software versions 16.6.1 through 16.6.2

Description A vulnerability in the Cisco Discovery Protocol (CDP) module could allow an unauthenticated, adjacent attacker to cause a memory leak that may lead to a denial of service (DoS) condition. The vulnerability is due to incorrect processing of certain CDP packets. An attacker could exploit this vulnerability by sending certain CDP packets to an affected device. A successful exploit could cause an affected device to continuously consume memory and eventually result in a memory allocation failure that leads to a crash, triggering a reload of the affected device.

Recommendations For Cisco IOS XE Software versions 16.6.1 and 16.6.2, update to a newer version that includes the software updates released by Cisco to address this vulnerability. At the moment, there is no information about a specific newer version that contains a fix for this vulnerability.

Fix

DoS

Resource Exhaustion

Missing Release of Resource after Effective Lifetime

Weakness Enumeration

CWE-400

CWE-772

Related Identifiers

CVE-2018-0471

Affected Products

Cisco Ios Xe

References · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-cdp-memleak · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-0471 · Security Note
• https://osv.dev/vulnerability/CVE-2018-0471 · Vendor Advisory
• http://securityfocus.com/bid/105398 · Note
• http://securitytracker.com/id/1041737 · Note