Remote DoS in Cisco IOS for Cisco Integrated Services Routers Generation 2

1) Denial of service

EUVDB-ID: #VU8613

Risk: Low

CVSSv4.0: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:A/U:Clear]

CVE-ID: CVE-2017-12232

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a misclassification of Ethernet frames. A remote attacker with access to local network can send a specially crafted Ethernet frame to an affected device and cause the device do reload, resulting in denial of service (DoS) attack. This vulnerability affects Cisco Integrated Services Routers Generation 2 (ISR G2) Routers that are running a vulnerable release of Cisco IOS Software.

Mitigation

Update to version 15.4(3)M6.2 or 15.4(3)M7.

Vulnerable software versions

Cisco 3900 Series Integrated Services Routers: 15.4.3 M

CPE2.3

• cpe:2.3:h:cisco_systems:cisco_3900_series_integrated_services_routers:15.4.3 M:*:*:*:*:*:*:*

External links

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-rbip-dos
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvc03809

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.