#VU11340 Improper input validation in Cisco IOS XE - CVE-2018-0164

Vulnerability identifier: #VU11340

Vulnerability risk: Medium

CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

CVE-ID: CVE-2018-0164

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerable software:
Cisco IOS XE

Software vendor:
Cisco Systems, Inc

The vulnerability allows a remote unauthenticated attacker to cause DoS condition on the target system.

The weakness exists in the Switch Integrated Security Features due to incorrect handling of crafted IPv6 packets. A remote attacker can send specially crafted IPv6 packets, trigger interface queue wedge and cause the service to crash.

Update to versions 16.7(0.51), 16.6.1a, 16.6.1, 16.6(0.221), 16.3(5.66), 15.6(2.18)S2.21, 15.6(2)SP3, 15.6(2)S4, 15.6(1.28)SP2, 15.5(3)S6.15, 15.5(1.0.91)SY1, 15.5(1)SY1, 15.5(1)IA1.363, 15.4(3)S9, 15.4(3)S8.7, 15.4(1.1.28)SY3, 15.4(1)SY3, 15.4(1)IC1.126, 15.2(6.3.0i)E, 15.2(6.2.16i)E, 15.2(6)E, 15.2(4.7.14)EA7, 15.2(2)E8, 15.2(1)SY6, 15.2(1)SY5.94, 8.3(0)SK(0.39), 7.0(3)INF7(0.6), 7.0(3)INF7(0), 7.0(3)IGH7(0.23), 7.0(3)IGH7(0), 7.0(3)IGC7(0.15), 7.0(3)IGC7(0), 7.0(3)IBB6(0.2), 7.0(3)IBB6(0), 7.0(3)I7(1) or 7.0(3)I7(0.110).

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-sisf