Sign-up

ID

VAR-201703-0903


CVE

CVE-2017-3850


TITLE

Cisco IOS Software and Cisco IOS XE Software input validation vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2017-002640

DESCRIPTION

A vulnerability in the Autonomic Networking Infrastructure (ANI) feature of Cisco IOS Software (15.4 through 15.6) and Cisco IOS XE Software (3.7 through 3.18, and 16) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to incomplete input validation on certain crafted packets. An attacker could exploit this vulnerability by sending a crafted IPv6 packet to a device that is running a Cisco IOS Software or Cisco IOS XE Software release that supports the ANI feature. A device must meet two conditions to be affected by this vulnerability: (1) the device must be running a version of Cisco IOS Software or Cisco IOS XE Software that supports ANI (regardless of whether ANI is configured); and (2) the device must have a reachable IPv6 interface. An exploit could allow the attacker to cause the affected device to reload. Cisco Bug IDs: CSCvc42729. Vendors have confirmed this vulnerability Bug ID CSCvc42729 It is released as.Service operation interruption (DoS) An attack may be carried out. Both Cisco IOS and IOSXESoftware are operating systems developed by Cisco Systems for their network devices. A remote attacker can exploit a vulnerability to send a specially crafted IPv6 packet for a denial of service attack

Trust: 2.52

sources: NVD: CVE-2017-3850 // JVNDB: JVNDB-2017-002640 // CNVD: CNVD-2017-03847 // BID: 96971 // VULHUB: VHN-112053

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2017-03847

AFFECTED PRODUCTS

vendor:ciscomodel:ios xescope:eqversion:3.18.1sp

Trust: 1.6

vendor:ciscomodel:ios xescope:eqversion:3.17.3s

Trust: 1.6

vendor:ciscomodel:ios xescope:eqversion:3.18.1s

Trust: 1.6

vendor:ciscomodel:ios xescope:eqversion:3.18.0as

Trust: 1.6

vendor:ciscomodel:ios xescope:eqversion:3.18.0sp

Trust: 1.6

vendor:ciscomodel:ios xescope:eqversion:3.17.2s

Trust: 1.6

vendor:ciscomodel:ios xescope:eqversion:3.18.1asp

Trust: 1.6

vendor:ciscomodel:ios xescope:eqversion:3.18.2s

Trust: 1.6

vendor:ciscomodel:ios xescope:eqversion:3.18.3vs

Trust: 1.6

vendor:ciscomodel:ios xescope:eqversion:3.18.1bsp

Trust: 1.6

vendor:ciscomodel:iosscope:eqversion:15.6\(2\)t1

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.16.1as

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.9.0e

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.16.4as

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.13.2s

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.16.1s

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.10.0s

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.15.0s

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.16.4s

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.10.2s

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.5\(1\)s

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.5\(1\)s4

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.13.6s

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.15.4s

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.16.0cs

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.3\(3\)s2

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.16.4bs

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.3\(3\)s

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.16.3s

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.15.2s

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.12.4s

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.2\(4\)e

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.10.4s

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.12.0as

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.7.4e

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.4\(1\)s3

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.4\(2\)s4

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.14.4s

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.7.1e

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.5\(3\)s

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.2\(3\)e

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.13.3s

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.11.1s

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.13.0s

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.10.8s

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.16.5s

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.4\(3\)s2

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.16.3as

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.13.4s

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.2\(5b\)e

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.7.3e

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.12.3s

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.5\(1\)s2

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.13.1s

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.4\(1\)s

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.6\(2\)t2

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.18.0s

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.3\(3\)s1

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.13.5s

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.5\(1\)s1

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.10.5s

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.4\(3\)s

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.5\(2\)s2

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.10.1xbs

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.5\(3\)s1a

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.6\(1\)s

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.6\(1\)s1

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.8.2e

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.11.3s

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.6\(2\)s

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.4\(3\)s1

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.3\(3\)s5

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.11.0s

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.16.0s

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.4\(2\)s1

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.7.0e

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.3\(3\)s3

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.4\(1\)s4

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.6\(1\)t1

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.13.5as

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.2\(3\)e2

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.6\(3\)m

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.14.0s

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.6\(1\)t2

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.6\(2\)t

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.16.2as

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.12.2s

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.7.2e

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.10.6s

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.5\(3\)s1

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.11.2s

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.5\(2\)s1

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.16.4ds

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.8.0e

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.9.1e

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.8.1e

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.3\(3\)s4

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.4\(1\)s1

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.11.4s

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.14.3s

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.15.1s

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.5\(1\)s3

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.4\(3\)s5

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.15.1cs

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.17.1as

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.17.1s

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.5\(3\)s0a

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.7.5e

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.2\(4\)e1

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.5\(2\)s3

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.13.6as

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.5\(2\)s

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.5\(3\)s3

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.10.3s

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.4\(2\)s3

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.6\(1\)t

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.15.3s

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.2\(3\)e3

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.2\(5\)e

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.4\(2\)s2

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.10.1s

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.8.3e

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.6\(1\)s2

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.13.0as

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.2\(3\)e1

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.4\(3\)s6

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.12.1s

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.5\(3\)s2

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.4\(3\)s4

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.14.2s

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.2\(4\)e2

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.10.7s

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.6\(2\)s1

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.6\(2\)sn

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.4\(3\)s3

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.16.2bs

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.17.0s

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.6\(1\)t0a

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.14.1s

Trust: 1.0

vendor:ciscomodel:ios xescope:eqversion:3.16.2s

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.5\(3\)sn

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.3\(3\)s6

Trust: 1.0

vendor:ciscomodel:iosscope:eqversion:15.4\(1\)s2

Trust: 1.0

vendor:ciscomodel:iosscope: - version: -

Trust: 0.8

vendor:ciscomodel:ios xescope: - version: -

Trust: 0.8

vendor:ciscomodel:ios softwarescope: - version: -

Trust: 0.6

vendor:ciscomodel:ios xe softwarescope: - version: -

Trust: 0.6

vendor:ciscomodel:ios xe softwarescope:eqversion:0

Trust: 0.3

vendor:ciscomodel:ios softwarescope:eqversion:0

Trust: 0.3

sources: CNVD: CNVD-2017-03847 // BID: 96971 // JVNDB: JVNDB-2017-002640 // CNNVD: CNNVD-201703-907 // NVD: CVE-2017-3850

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-3850
value: MEDIUM

Trust: 1.0

NVD: CVE-2017-3850
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2017-03847
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201703-907
value: MEDIUM

Trust: 0.6

VULHUB: VHN-112053
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2017-3850
severity: HIGH
baseScore: 7.1
vectorString: AV:N/AC:M/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2017-03847
severity: HIGH
baseScore: 7.1
vectorString: AV:N/AC:M/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-112053
severity: HIGH
baseScore: 7.1
vectorString: AV:N/AC:M/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2017-3850
baseSeverity: MEDIUM
baseScore: 5.9
vectorString: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 2.2
impactScore: 3.6
version: 3.0

Trust: 1.8

sources: CNVD: CNVD-2017-03847 // VULHUB: VHN-112053 // JVNDB: JVNDB-2017-002640 // CNNVD: CNNVD-201703-907 // NVD: CVE-2017-3850

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.9

sources: VULHUB: VHN-112053 // JVNDB: JVNDB-2017-002640 // NVD: CVE-2017-3850

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201703-907

TYPE

Input Validation Error

Trust: 0.9

sources: BID: 96971 // CNNVD: CNNVD-201703-907

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-002640

PATCH
title:cisco-sa-20170320-aniipv6url:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170320-aniipv6
Trust: 0.8
title:Patch for CiscoIOS and IOSXESoftwareANIIPv6 Message Denial of Service Vulnerabilitiesurl:https://www.cnvd.org.cn/patchInfo/show/91481
Trust: 0.6
title:Cisco IOS  and IOS XE Software Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=68658
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2017-03847 // 
            
            
            
            JVNDB: JVNDB-2017-002640 // 
            
            
            
            CNNVD: CNNVD-201703-907

EXTERNAL IDS
db:NVDid:CVE-2017-3850
Trust: 3.4
db:BIDid:96971
Trust: 2.6
db:SECTRACKid:1038065
Trust: 1.7
db:JVNDBid:JVNDB-2017-002640
Trust: 0.8
db:CNNVDid:CNNVD-201703-907
Trust: 0.7
db:CNVDid:CNVD-2017-03847
Trust: 0.6
db:VULHUBid:VHN-112053
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2017-03847 // 
            
            
            
            VULHUB: VHN-112053 // 
            
            
            
            BID: 96971 // 
            
            
            
            JVNDB: JVNDB-2017-002640 // 
            
            
            
            CNNVD: CNNVD-201703-907 // 
            
            
            
            NVD: CVE-2017-3850

REFERENCES
url:http://www.securityfocus.com/bid/96971
Trust: 2.3
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20170320-aniipv6
Trust: 2.0
url:http://www.securitytracker.com/id/1038065
Trust: 1.7
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-3850
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2017-3850
Trust: 0.8
url:http://www.cisco.com/
Trust: 0.3
url:http://www.cisco.com/en/us/products/sw/iosswrel/products_ios_cisco_ios_software_category_home.html
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2017-03847 // 
            
            
            
            VULHUB: VHN-112053 // 
            
            
            
            BID: 96971 // 
            
            
            
            JVNDB: JVNDB-2017-002640 // 
            
            
            
            CNNVD: CNNVD-201703-907 // 
            
            
            
            NVD: CVE-2017-3850

CREDITS
Omar Eissa of ERNW.
Trust: 0.9
sources:
            
            
            BID: 96971 // 
            
            
            
            CNNVD: CNNVD-201703-907

SOURCES
db:CNVDid:CNVD-2017-03847
db:VULHUBid:VHN-112053
db:BIDid:96971
db:JVNDBid:JVNDB-2017-002640
db:CNNVDid:CNNVD-201703-907
db:NVDid:CVE-2017-3850

LAST UPDATE DATE
2024-11-23T22:22:35.509000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2017-03847date:2017-04-03T00:00:00
db:VULHUBid:VHN-112053date:2019-10-09T00:00:00
db:BIDid:96971date:2017-03-23T00:01:00
db:JVNDBid:JVNDB-2017-002640date:2017-04-24T00:00:00
db:CNNVDid:CNNVD-201703-907date:2019-10-17T00:00:00
db:NVDid:CVE-2017-3850date:2024-11-21T03:26:14.433

SOURCES RELEASE DATE
db:CNVDid:CNVD-2017-03847date:2017-04-05T00:00:00
db:VULHUBid:VHN-112053date:2017-03-21T00:00:00
db:BIDid:96971date:2017-03-20T00:00:00
db:JVNDBid:JVNDB-2017-002640date:2017-04-24T00:00:00
db:CNNVDid:CNNVD-201703-907date:2017-03-21T00:00:00
db:NVDid:CVE-2017-3850date:2017-03-21T16:59:00.257