CVE-2018-0136

Severity Score

8.6

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A vulnerability in the IPv6 subsystem of Cisco IOS XR Software Release 5.3.4 for the Cisco Aggregation Services Router (ASR) 9000 Series could allow an unauthenticated, remote attacker to trigger a reload of one or more Trident-based line cards, resulting in a denial of service (DoS) condition. The vulnerability is due to incorrect handling of IPv6 packets with a fragment header extension. An attacker could exploit this vulnerability by sending IPv6 packets designed to trigger the issue either to or through the Trident-based line card. A successful exploit could allow the attacker to trigger a reload of Trident-based line cards, resulting in a DoS during the period of time the line card takes to restart. This vulnerability affects Cisco Aggregation Services Router (ASR) 9000 Series when the following conditions are met: The router is running Cisco IOS XR Software Release 5.3.4, and the router has installed Trident-based line cards that have IPv6 configured. A software maintenance upgrade (SMU) has been made available that addresses this vulnerability. The fix has also been incorporated into service pack 7 for Cisco IOS XR Software Release 5.3.4. Cisco Bug IDs: CSCvg46800.

Una vulnerabilidad en el subsistema IPv6 de Cisco IOS XR Software Release 5.3.4 para Cisco Aggregation Services Router (ASR) 9000 Series podría permitir que un atacante remoto no autenticado desencadene la recarga de una o más tarjetas de línea Trident, lo que resulta en una condición de denegación de servicio (DoS). La vulnerabilidad se debe a la manipulación incorrecta de paquetes IPv6 con una extensión de cabecera de fragmento. Un atacante podría explotar esta vulnerabilidad enviando paquetes IPv6 diseñados para provocar este problema en o a través de la tarjeta de línea Trident. Un exploit con éxito podría permitir que el atacante desencadene la recarga de las tarjetas de línea Trident, lo que resulta en un DoS durante el período de tiempo que la tarjeta necesita para reiniciarse. Esta vulnerabilidad afecta a Cisco Aggregation Services Router (ASR) 9000 Series cuando se cumplen las siguientes condiciones: el router ejecuta Cisco IOS XR Software Release 5.3.4 y tiene instaladas tarjetas de línea Trident con IPv6 configurado. Se ha puesto en disposición de los usuarios una actuación del mantenimiento de software (SMU) que aborda esta vulnerabilidad. La solución también se ha incorporado en service pack 7 para Cisco IOS XR Software Release 5.3.4. Cisco Bug IDs: CSCvg46800.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

None

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2017-11-27 CVE Reserved
2018-01-31 CVE Published
2023-08-03 EPSS Updated
2024-08-05 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-20: Improper Input Validation

CAPEC

References (3)

URL	Tag	Source
http://www.securityfocus.com/bid/102905	Third Party Advisory
http://www.securitytracker.com/id/1040315	Third Party Advisory

URL	Date	SRC

URL	Date	SRC
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180131-ipv6	2020-09-04

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Cisco Search vendor "Cisco"	Ios Xr Search vendor "Cisco" for product "Ios Xr"	5.3.4 Search vendor "Cisco" for product "Ios Xr" and version "5.3.4"	-	Affected	in	Cisco Search vendor "Cisco"	Asr 9001 Search vendor "Cisco" for product "Asr 9001"	-	-	Safe
Cisco Search vendor "Cisco"	Ios Xr Search vendor "Cisco" for product "Ios Xr"	5.3.4 Search vendor "Cisco" for product "Ios Xr" and version "5.3.4"	-	Affected	in	Cisco Search vendor "Cisco"	Asr 9006 Search vendor "Cisco" for product "Asr 9006"	-	-	Safe
Cisco Search vendor "Cisco"	Ios Xr Search vendor "Cisco" for product "Ios Xr"	5.3.4 Search vendor "Cisco" for product "Ios Xr" and version "5.3.4"	-	Affected	in	Cisco Search vendor "Cisco"	Asr 9010 Search vendor "Cisco" for product "Asr 9010"	-	-	Safe
Cisco Search vendor "Cisco"	Ios Xr Search vendor "Cisco" for product "Ios Xr"	5.3.4 Search vendor "Cisco" for product "Ios Xr" and version "5.3.4"	-	Affected	in	Cisco Search vendor "Cisco"	Asr 9904 Search vendor "Cisco" for product "Asr 9904"	-	-	Safe
Cisco Search vendor "Cisco"	Ios Xr Search vendor "Cisco" for product "Ios Xr"	5.3.4 Search vendor "Cisco" for product "Ios Xr" and version "5.3.4"	-	Affected	in	Cisco Search vendor "Cisco"	Asr 9906 Search vendor "Cisco" for product "Asr 9906"	-	-	Safe
Cisco Search vendor "Cisco"	Ios Xr Search vendor "Cisco" for product "Ios Xr"	5.3.4 Search vendor "Cisco" for product "Ios Xr" and version "5.3.4"	-	Affected	in	Cisco Search vendor "Cisco"	Asr 9910 Search vendor "Cisco" for product "Asr 9910"	-	-	Safe
Cisco Search vendor "Cisco"	Ios Xr Search vendor "Cisco" for product "Ios Xr"	5.3.4 Search vendor "Cisco" for product "Ios Xr" and version "5.3.4"	-	Affected	in	Cisco Search vendor "Cisco"	Asr 9912 Search vendor "Cisco" for product "Asr 9912"	-	-	Safe
Cisco Search vendor "Cisco"	Ios Xr Search vendor "Cisco" for product "Ios Xr"	5.3.4 Search vendor "Cisco" for product "Ios Xr" and version "5.3.4"	-	Affected	in	Cisco Search vendor "Cisco"	Asr 9922 Search vendor "Cisco" for product "Asr 9922"	-	-	Safe