PT-2019-1979 · Cisco · Cisco Prime Network Registrar
Published
2019-04-17
·
Updated
2019-10-09
·
CVE-2019-1840
CVSS v3.1
8.6
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Cisco Prime Network Registrar versions prior to 8.3(7) and 9.1(2)
Description
The issue is related to the incorrect initialization in the DHCPv6 input packet processor of Cisco Prime Network Registrar. This could allow a remote attacker to cause a denial of service (DoS) condition by sending malformed DHCPv6 packets. The vulnerability is due to incomplete user-supplied input validation when a custom extension attempts to change a DHCPv6 packet. An attacker could exploit this by sending malformed packets, potentially leading to a restart of the service and, if repeated, a DoS condition. This vulnerability can only be exploited if custom extensions that attempt to modify packet details before processing are installed.
Recommendations
For versions prior to 8.3(7), update to version 8.3(7) or later to resolve the issue.
For versions prior to 9.1(2), update to version 9.1(2) or later to resolve the issue.
As a temporary workaround, consider disabling custom extensions that modify packet parameters until a patch is available. Restrict access to the DHCPv6 packet processor to minimize the risk of exploitation. Avoid using custom extensions that attempt to modify packet details before the packet has been sanitized until the issue is resolved.
Fix
Improper Initialization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cisco Prime Network Registrar