#VU11356 Memory leak in Cisco IOS XE - CVE-2018-0158
Published: March 30, 2018 / Updated: March 8, 2022
Vulnerability identifier: #VU11356
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:A/U:Green
CVE-ID: CVE-2018-0158
CWE-ID: CWE-401
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerable software:
Cisco IOS XE
Cisco IOS XE
Software vendor:
Cisco Systems, Inc
Cisco Systems, Inc
Description
The vulnerability allows a remote unauthenticated attacker to cause DoS condition on the target system.
The weakness exists in the Internet Key Exchange Version 2 (IKEv2) module due to incorrect processing of certain IKEv2 packets. A remote attacker can send specially crafted IKEv2 packets, trigger memory leak and cause the service to crash.
The weakness exists in the Internet Key Exchange Version 2 (IKEv2) module due to incorrect processing of certain IKEv2 packets. A remote attacker can send specially crafted IKEv2 packets, trigger memory leak and cause the service to crash.
Remediation
Update to versions 16.4(2.68), 16.3.5b, 16.3.5, 16.3(4.67), 15.7(3.1.14A)OT, 15.7(3.1.5U)OT, 15.7(3)M1, 15.7(3)M, 15.7(2.0v)M0.2, 15.7(2.0y)M, 15.6(3)M3, 15.6(2.18)S2.23, 15.6(2)T3, 15.6(2)SP3, 15.6(2)S4, 15.6(1.41)SP2, 15.5(3)S6a, 15.5(3)S6, 15.5(3)S5.31, 15.5(3)M6, 15.5(1.0.93)SY1, 15.5(1.0.91)SY1, 15.5(1)SY1, 15.5(1)IA1.428, 15.4(1.1.13)SY3, 15.4(1)SY3, 15.2(6.5.1i)E1, 15.2(6.4.66i)E1, 15.2(6.3.0i)E, 15.2(6.2.20i)E, 15.2(6)E1, 15.2(4.6.22)EA5, 15.2(4)EA6 or 15.2(4)E5.