Improper input validation in Cisco IOS XE - CVE-2018-0164

Vulnerability identifier: #VU11340

CSH Severity: Medium

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

CVE-ID: CVE-2018-0164

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vendor: Cisco Systems, Inc

Affected software:
Cisco IOS XE

The vulnerability allows a remote unauthenticated attacker to cause DoS condition on the target system.

The weakness exists in the Switch Integrated Security Features due to incorrect handling of crafted IPv6 packets. A remote attacker can send specially crafted IPv6 packets, trigger interface queue wedge and cause the service to crash.

Update to versions 16.7(0.51), 16.6.1a, 16.6.1, 16.6(0.221), 16.3(5.66), 15.6(2.18)S2.21, 15.6(2)SP3, 15.6(2)S4, 15.6(1.28)SP2, 15.5(3)S6.15, 15.5(1.0.91)SY1, 15.5(1)SY1, 15.5(1)IA1.363, 15.4(3)S9, 15.4(3)S8.7, 15.4(1.1.28)SY3, 15.4(1)SY3, 15.4(1)IC1.126, 15.2(6.3.0i)E, 15.2(6.2.16i)E, 15.2(6)E, 15.2(4.7.14)EA7, 15.2(2)E8, 15.2(1)SY6, 15.2(1)SY5.94, 8.3(0)SK(0.39), 7.0(3)INF7(0.6), 7.0(3)INF7(0), 7.0(3)IGH7(0.23), 7.0(3)IGH7(0), 7.0(3)IGC7(0.15), 7.0(3)IGC7(0), 7.0(3)IBB6(0.2), 7.0(3)IBB6(0), 7.0(3)I7(1) or 7.0(3)I7(0.110).

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-sisf