Cisco SD-WAN Solution up to 18.2.x Zero Touch Provisioning Packet memory corruption

Summaryinfo

A vulnerability was found in Cisco SD-WAN Solution up to 18.2.x. It has been rated as problematic. The affected element is an unknown function of the component Zero Touch Provisioning. The manipulation as part of Packet leads to memory corruption. This vulnerability is traded as CVE-2018-0346. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Cisco SD-WAN Solution up to 18.2.x (Network Management Software) and classified as problematic. This issue affects an unknown function of the component Zero Touch Provisioning. The manipulation as part of a Packet leads to a memory corruption vulnerability. Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. Impacted is availability. The summary by CVE is:

A vulnerability in the Zero Touch Provisioning service of the Cisco SD-WAN Solution could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to incorrect bounds checks for certain values in packets that are sent to the Zero Touch Provisioning service of the affected software. An attacker could exploit this vulnerability by sending malicious packets to the affected software for processing. When the software processes the packets, a buffer overflow condition could occur and cause an affected device to reload. A successful exploit could allow the attacker to cause a temporary DoS condition while the device reloads. This vulnerability can be exploited only by traffic that is destined for an affected device. It cannot be exploited by traffic that is transiting a device. This vulnerability affects the following Cisco products if they are running a release of the Cisco SD-WAN Solution prior to Release 18.3.0: vBond Orchestrator Software, vManage Network Management Software, vSmart Controller Software. Cisco Bug IDs: CSCvi69914.

The bug was discovered 07/18/2018. The weakness was shared 07/18/2018 with Cisco as cisco-sa-20180718-sdwan-dos as confirmed advisory (Website). It is possible to read the advisory at tools.cisco.com. The identification of this vulnerability is CVE-2018-0346 since 11/27/2017. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 18.3.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 104855†). The entries VDB-121923, VDB-121922, VDB-121921 and VDB-121920 are related to this item. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Network Management Software

Vendor

• Cisco

Name

• SD-WAN Solution

Version

• 18.0
• 18.1
• 18.2

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion