Cisco IOS XE Switch Integrated Security IPv6 Packet resource management

Summaryinfo

A vulnerability was found in Cisco IOS XE and classified as problematic. This impacts an unknown function of the component Switch Integrated Security. Executing a manipulation as part of IPv6 Packet can lead to resource management. This vulnerability appears as CVE-2018-0164. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability has been found in Cisco IOS XE (Router Operating System) (the affected version is unknown) and classified as critical. This vulnerability affects an unknown code of the component Switch Integrated Security. The manipulation as part of a IPv6 Packet leads to a resource management vulnerability. The CWE definition for the vulnerability is CWE-399. As an impact it is known to affect availability. CVE summarizes:

A vulnerability in the Switch Integrated Security Features of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an interface queue wedge. The vulnerability is due to incorrect handling of crafted IPv6 packets. An attacker could exploit this vulnerability by sending crafted IPv6 packets through the device. An exploit could allow the attacker to cause an interface queue wedge. This vulnerability affects the Cisco cBR-8 Converged Broadband Router, Cisco ASR 1000 Series Aggregation Services Routers, and Cisco Cloud Services Router 1000V Series when configured with IPv6. In the field and internal testing, this vulnerability was only observed or reproduced on the Cisco cBR-8 Converged Broadband Router. The Cisco ASR 1000 Series Aggregation Services Routers and Cisco Cloud Services Router 1000V Series contain the same code logic, so affected trains have had the code fix applied; however, on these two products, the vulnerability has not been observed in the field or successfully reproduced internally. Cisco Bug IDs: CSCvd75185.

The bug was discovered 03/28/2018. The weakness was presented 03/28/2018 as cisco-sa-20180328-sisf as confirmed advisory (Website). The advisory is shared for download at tools.cisco.com. This vulnerability was named CVE-2018-0164 since 11/27/2017. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 01/17/2020).

The commercial vulnerability scanner Qualys is able to test this issue with plugin 316226 (Cisco IOS XE Software Switch Integrated Security Features IPv6 Denial of Service Vulnerability(cisco-sa-20180328-sisf)).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 103553†). See VDB-115171, VDB-115172, VDB-115169 and VDB-115165 for similar entries. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Router Operating System

Vendor

• Cisco

Name

• IOS XE

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion