Heap-based buffer overflow in Cisco IOS XE - CVE-2018-0172

Vulnerability identifier: #VU11363

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-0172

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

The vulnerability allows a remote unauthenticated attacker to cause DoS condition on the target system.

The weakness exists in the DHCP option 82 encapsulation functionality due to incomplete input validation of option 82 information that it receives in DHCP Version 4 (DHCPv4) packets from DHCP relay agents. A remote attacker can send a specially crafted DHCPv4 packet, trigger heap overflow and cause the service to crash.

Cisco IOS XE

Allen-Bradley Stratix 8300 Modular Managed Ethernet Switches
Allen-Bradley Stratix 5400 Industrial Ethernet Switches
Allen-Bradley Stratix 5410 Industrial Distribution Switches
Allen-Bradley Stratix 5700 Industrial Managed Ethernet Switches
Allen-Bradley ArmorStratix 5700 Industrial Managed Ethernet Switches
Allen-Bradley Stratix 8000 Modular Managed Ethernet Switches

Update to versions 16.6(2.65), 16.5(1.321), 16.3(5.72), 15.6(2.18)SP3, 15.6(2)SP4, 15.5(3)S6.23, 15.4(3)S9, 15.2(6.5.1i)E1, 15.2(6.4.66i)E1, 15.2(6.4.62i)E1, 15.2(6)E1, 15.2(4.7.3)EA7, 15.0(1.9.1)SQD8 or 12.2(60)EZ13.

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-dhcpr1

• Multiple vulnerabilities in Cisco IOS XE
• Multiple vulnerabilities in Rockwell Automation Stratix and ArmorStratix Switches
• Multiple vulnerabilities in Rockwell Automation Allen-Bradley Stratix 8300 Industrial Managed Ethernet Switches