Cisco IOS/IOS XE Network-Based Application Recognition input validation

Summaryinfo

A vulnerability marked as problematic has been reported in Cisco IOS and IOS XE. This issue affects some unknown processing of the component Network-Based Application Recognition. The manipulation leads to input validation. This vulnerability is documented as CVE-2019-1740. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in Cisco IOS and IOS XE (Router Operating System) (the affected version is unknown) and classified as problematic. This issue affects an unknown code of the component Network-Based Application Recognition. The manipulation with an unknown input leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Impacted is availability. The summary by CVE is:

A vulnerability in the Network-Based Application Recognition (NBAR) feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. This vulnerability are due to a parsing issue on DNS packets. An attacker could exploit this vulnerability by sending crafted DNS packets through routers that are running an affected version and have NBAR enabled. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a denial of service (DoS) condition.

The bug was discovered 03/27/2019. The weakness was released 03/28/2019 as cisco-sa-20190327-nbar as confirmed advisory (Website). The advisory is shared at tools.cisco.com. The identification of this vulnerability is CVE-2019-1740 since 12/06/2018. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 05/22/2020).

The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $5k-$25k. The commercial vulnerability scanner Qualys is able to test this issue with plugin 316394 (Cisco IOS and IOS XE Software Network-Based Application Recognition Denial of Service Vulnerabilities(cisco-sa-20190327-nbar)).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 107597†). Entries connected to this vulnerability are available at VDB-132519 and VDB-132520. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• Cisco

Name

• IOS
• IOS XE

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion