Denial of service in Cisco ASR 9000 Series Routers

1) Improper input validation

EUVDB-ID: #VU10339

Risk: Medium

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-0136

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition no the target system.

The vulnerability exists in the IPv6 subsystem due to incorrect handling of IPv6 packets with a fragment header extension. A remote attacker can send specially crafted IPv6 packets designed to trigger the issue either to or through the Trident-based line card and cause the Trident-based line cards to reload during the period of time the line card takes to restart.

Successful exploitation of the vulnerability results in denial of service.

Mitigation

Update to version 5.3.4.

Vulnerable software versions

Cisco ASR 9922 Router: All versions

Cisco ASR 9912 Router: All versions

Cisco ASR 9001 Router: All versions

Cisco ASR 9006 Router: All versions

Cisco ASR 9904 Router: All versions

Cisco ASR 9010 Router: All versions

Cisco ASR 9000 Series Aggregation Services Routers: All versions

External links

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180131-ipv6

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.