Cisco IOS XE IP SLA Responder Packet state issue

Summaryinfo

A vulnerability categorized as problematic has been discovered in Cisco IOS XE. Affected by this vulnerability is an unknown functionality of the component IP SLA Responder. Such manipulation as part of Packet leads to state issue. This vulnerability is documented as CVE-2020-3422. The attack can be executed remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Cisco IOS XE (Router Operating System) (affected version unknown). Affected by this issue is an unknown functionality of the component IP SLA Responder. The manipulation as part of a Packet leads to a state issue vulnerability. Using CWE to declare the problem leads to CWE-371. Impacted is availability. CVE summarizes:

A vulnerability in the IP Service Level Agreement (SLA) responder feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the IP SLA responder to reuse an existing port, resulting in a denial of service (DoS) condition. The vulnerability exists because the IP SLA responder could consume a port that could be used by another feature. An attacker could exploit this vulnerability by sending specific IP SLA control packets to the IP SLA responder on an affected device. The control packets must include the port number that could be used by another configured feature. A successful exploit could allow the attacker to cause an in-use port to be consumed by the IP SLA responder, impacting the feature that was using the port and resulting in a DoS condition.

The weakness was released 09/24/2020 as cisco-sa-ipsla-jw2DJmSv as confirmed advisory (Website). The advisory is shared for download at tools.cisco.com. This vulnerability is handled as CVE-2020-3422 since 12/12/2019. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 09/25/2020).

Upgrading eliminates this vulnerability.

Entries connected to this vulnerability are available at VDB-161880, VDB-161878, VDB-161877 and VDB-161875. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• Cisco

Name

• IOS XE

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion