Cisco IOS XE Umbrella IP Packet use after free

Summaryinfo

A vulnerability categorized as problematic has been discovered in Cisco IOS XE. This affects an unknown part of the component Umbrella. Such manipulation as part of IP Packet leads to use after free. This vulnerability is uniquely identified as CVE-2018-0170. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Cisco IOS XE (Router Operating System) (affected version unknown). It has been rated as problematic. Affected by this issue is an unknown functionality of the component Umbrella. The manipulation as part of a IP Packet leads to a use after free vulnerability. Using CWE to declare the problem leads to CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. Impacted is availability. CVE summarizes:

A vulnerability in the Cisco Umbrella Integration feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition, related to the OpenDNS software. The vulnerability is due to a logic error that exists when handling a malformed incoming packet, leading to access to an internal data structure after it has been freed. An attacker could exploit this vulnerability by sending crafted, malformed IP packets to an affected device. A successful exploit could allow the attacker to cause an affected device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCvb86327.

The bug was discovered 03/28/2018. The weakness was disclosed 03/28/2018 as cisco-sa-20180328-opendns-dos as confirmed advisory (Website). The advisory is shared for download at tools.cisco.com. This vulnerability is handled as CVE-2018-0170 since 11/27/2017. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 02/06/2021).

The commercial vulnerability scanner Qualys is able to test this issue with plugin 316211 (Cisco IOS XE Software with Cisco Umbrella Integration Denial of Service Vulnerability(cisco-sa-20180328-opendns-dos)).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 103560†). The entries VDB-115171, VDB-115169 and VDB-115168 are pretty similar. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• Cisco

Name

• IOS XE

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion