Cisco IOS XE SNMP Subsystem double free

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Cisco IOS XE. The affected element is an unknown function of the component SNMP Subsystem. This manipulation causes double free. This vulnerability is registered as CVE-2018-0160. Remote exploitation of the attack is possible. No exploit is available. It is advisable to implement restrictive firewalling.

Detailsinfo

A vulnerability classified as problematic was found in Cisco IOS XE (Router Operating System) (affected version unknown). Affected by this vulnerability is an unknown functionality of the component SNMP Subsystem. The manipulation with an unknown input leads to a double free vulnerability. The CWE definition for the vulnerability is CWE-415. The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations. As an impact it is known to affect availability. The summary by CVE is:

A vulnerability in Simple Network Management Protocol (SNMP) subsystem of Cisco IOS XE Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to improper management of memory resources, referred to as a double free. An attacker could exploit this vulnerability by sending crafted SNMP packets to an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. To exploit this vulnerability via SNMP Version 2c or earlier, the attacker must know the SNMP read-only community string for an affected system. To exploit this vulnerability via SNMP Version 3, the attacker must know the user credentials for the affected system. This vulnerability affects Cisco devices that are running a vulnerable release of Cisco IOS XE Software, have been configured to be queried over SNMP, and have Network Address Translation (NAT) enabled. Cisco Bug IDs: CSCve75818.

The bug was discovered 03/28/2018. The weakness was published 03/28/2018 as cisco-sa-20180328-snmp-dos as confirmed advisory (Website). The advisory is shared at tools.cisco.com. This vulnerability is known as CVE-2018-0160 since 11/27/2017. The attack can be launched remotely. The successful exploitation needs a single authentication. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 02/06/2021).

The commercial vulnerability scanner Qualys is able to test this issue with plugin 316208 (Cisco IOS XE Software Simple Network Management Protocol Double-Free Denial of Service Vulnerability(cisco-sa-20180328-snmp-dos)).

Proper firewalling of udp/161 (snmp) is able to address this issue.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 103575†). Similar entries are available at VDB-115169, VDB-115168 and VDB-115162. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Router Operating System

Vendor

• Cisco

Name

• IOS XE

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion