SB2018090718 - Denial of service in Cisco Prime Access Registrar
Published: September 7, 2018
Security Bulletin ID
SB2018090718
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Improper input validation (CVE-ID: CVE-2018-0421)
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The vulnerability exists in TCP connection management in Cisco Prime Access Registrar due to incorrect handling of incoming TCP SYN packets to specific listening ports. A remote attacker can send a specially crafted stream of TCP SYN packets and cause the application to eventually restart if a file description cannot be obtained.
Remediation
Install update from vendor's website.