SB2018011903 - Denial of service in Cisco UCS Central Software



SB2018011903 - Denial of service in Cisco UCS Central Software

Published: January 19, 2018

Security Bulletin ID SB2018011903
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Partial DoS

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Denial of service (CVE-ID: CVE-2018-0094)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in IPv6 ingress packet processing for Cisco UCS Central Software due to insufficient rate limiting protection for IPv6 ingress traffic. A remote attacker can send a high rate of IPv6 packets, trigger CPU and resource constraints and cause the service to crash.

Remediation

Install update from vendor's website.