SB2020010909 - Denial of service in Cisco Mobility Management Entity
Published: January 9, 2020
Security Bulletin ID
SB2020010909
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Input validation error (CVE-ID: CVE-2019-16026)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack on an eNodeB that is connected to an affected device.
The vulnerability exists due to insufficient validation of user-supplied input in the implementation of the Stream Control Transmission Protocol (SCTP). A remote attacker can leverage a man-in-the-middle
position between the eNodeB and the MME, then send a specially crafted SCTP
message to the MME and cause the MME to stop
sending SCTP messages to the eNodeB, results in denial of service condition.
Remediation
Install update from vendor's website.