Denial of service in Cisco Virtualized Packet Core - CVE-2018-0117
Published: February 8, 2018 / Updated: February 12, 2018
Vulnerability identifier: #VU10406
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2018-0117
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Cisco Systems, Inc
Affected software:
Cisco Virtualized Packet Core
Cisco Virtualized Packet Core
Detailed vulnerability description
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The weakness in the ingress packet processing functionality of the Cisco Virtualized Packet Core-Distributed Instance (VPC-DI) Software due to improper handling of user-supplied input. A remote attacker can send malicious traffic to the internal distributed instance (DI) network address, trigger an unhandled error condition, cause the CF instances and the entire VPC to reload, resulting in the disconnection of all subscribers and denial of service.
The weakness in the ingress packet processing functionality of the Cisco Virtualized Packet Core-Distributed Instance (VPC-DI) Software due to improper handling of user-supplied input. A remote attacker can send malicious traffic to the internal distributed instance (DI) network address, trigger an unhandled error condition, cause the CF instances and the entire VPC to reload, resulting in the disconnection of all subscribers and denial of service.
How to mitigate CVE-2018-0117
The vulnerability is addressed in the following versions: 21.6.M0.6851421.6.M0.68511, 21.6.D0.68515, 21.6.0.68618, 21.6.0, 21.4.A0.67147, 21.3.a0.68015, 21.3.M0.67142, 21.3.J0.67141, 21.3.0, 21.1.v7.68510, 21.1.v7.