Double free error in Cisco IOS XE - CVE-2018-0160
Published: March 29, 2018 / Updated: March 29, 2018
Vulnerability identifier: #VU11334
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2018-0160
CWE-ID: CWE-415
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Cisco Systems, Inc
Affected software:
Cisco IOS XE
Cisco IOS XE
Detailed vulnerability description
The vulnerability allows a remote authenticated attacker to cause DoS condition on the target system.
The weakness exists in Simple Network Management Protocol (SNMP) subsystem due to improper management of memory resources. A remote attacker can send specially crafted SNMP packets, trigger double free error and cause the service to crash.
The weakness exists in Simple Network Management Protocol (SNMP) subsystem due to improper management of memory resources. A remote attacker can send specially crafted SNMP packets, trigger double free error and cause the service to crash.
How to mitigate CVE-2018-0160
Update to versions 16.7(0.88), 16.6.2, 16.6(1.68), 16.5(1.321), 16.3.5b, 16.3.5, 16.3(4.88) or 15.6(2.14)SP3.