PT-2019-1174 · Cisco · Cisco Ios+1

Published 2019-01-09 · Updated 2020-08-28 · CVE-2018-0282

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS and Cisco IOS XE Software (affected versions not specified)

Description The issue is related to errors in managing the state of TCP sockets in Cisco IOS and Cisco IOS XE Software. This could allow a remote attacker to cause the device to reload by sending specially crafted HTTP requests, resulting in a denial of service (DoS) condition. The vulnerability is due to a state condition between the socket state and the transmission control block (TCB) state, and it potentially affects all TCP applications, although only the HTTP server has been observed to be affected so far.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-371

Related Identifiers

BDU:2019-00241

CVE-2018-0282

Affected Products

Cisco Ios

Cisco Ios Xe

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-0282 · Security Note
• https://osv.dev/vulnerability/CVE-2018-0282 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190109-tcp · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00241 · Security Note
• http://securityfocus.com/bid/106510 · Note