CVE-2017-12217
 
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A vulnerability in the General Packet Radio Service (GPRS) Tunneling Protocol ingress packet handler of Cisco ASR 5500 System Architecture Evolution (SAE) Gateways could allow an unauthenticated, remote attacker to cause a partial denial of service (DoS) condition on an affected device. The vulnerability is due to improper input validation of GPRS Tunneling Protocol packet headers. An attacker could exploit this vulnerability by sending a malformed GPRS Tunneling Protocol packet to an affected device. A successful exploit could allow the attacker to cause the GTPUMGR process on an affected device to restart unexpectedly, resulting in a partial DoS condition. If the GTPUMGR process restarts, there could be a brief impact on traffic passing through the device. Cisco Bug IDs: CSCve07119.
Una vulnerabilidad en el gestor de paquetes de entrada del protocolo de túnel GPRS (General Packet Radio Service) de Cisco ASR 5500 System Architecture Evolution (SAE) Gateways podría permitir a un atacante remoto no autenticado provocar una denegación de servicio (DoS) parcial en el dispositivo afectado. Esta vulnerabilidad se debe a una validación incorrecta de entradas de las cabeceras de los paquetes de protocolo de túnel GPRS. Un atacante podría explotar esta vulnerabilidad mediante el envío de un paquete de protocolo de túnel GPRS mal formado a un dispositivo afectado. Una explotación con éxito podría permitir que el atacante provoque que el proceso GTPUMGR de un dispositivo afectado se reinicie de manera inesperada, lo que da lugar a una denegación de servicio (DoS) parcial. Si el proceso GTPUMGR se reinicia, podría produirse un leve impacto en el tráfico que pasa a través del dispositivo. Cisco Bug IDs: CSCve07119.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2017-08-03 CVE Reserved
- 2017-09-07 CVE Published
- 2023-03-10 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-20: Improper Input Validation
CAPEC
References (3)
URL | Tag | Source |
---|---|---|
http://www.securityfocus.com/bid/100642 | Third Party Advisory | |
http://www.securitytracker.com/id/1039276 | Third Party Advisory |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-asr | 2019-10-09 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Cisco Search vendor "Cisco" | Asr 5500 Firmware Search vendor "Cisco" for product "Asr 5500 Firmware" | - | - |
Affected
| in | Cisco Search vendor "Cisco" | Asr 5500 Search vendor "Cisco" for product "Asr 5500" | - | - |
Safe
|