Details of VAR-201706-0558

ID

VAR-201706-0558

CVE

CVE-2017-6678

TITLE

Cisco Virtualized Packet Core-Distributed Instance Software ingress UDP Vulnerability related to resource management in packet processing function

Trust: 0.8

sources: JVNDB: JVNDB-2017-005145

DESCRIPTION

A vulnerability in the ingress UDP packet processing functionality of Cisco Virtualized Packet Core-Distributed Instance (VPC-DI) Software 19.2 through 21.0 could allow an unauthenticated, remote attacker to cause both control function (CF) instances on an affected system to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient handling of user-supplied data by the affected software. An attacker could exploit this vulnerability by sending crafted UDP packets to the distributed instance (DI) network addresses of both CF instances on an affected system. A successful exploit could allow the attacker to cause an unhandled error condition on the affected system, which would cause the CF instances to reload and consequently cause the entire VPC to reload, resulting in the disconnection of all subscribers and a DoS condition on the affected system. This vulnerability can be exploited via IPv4 traffic only. Cisco Bug IDs: CSCvc01665 CSCvc35565. Vendors have confirmed this vulnerability Bug ID CSCvc01665 and CSCvc35565 It is released as.Service operation interruption (DoS) There is a possibility of being put into a state. Cisco Virtualized Packet Core (VPC) is a StarOS version classified by product. The following products and versions are affected: Cisco Virtualized Packet Core-Distributed Instance Software Release N5.1, Release N5.0, Release N4.7, Release N4.6, Release N4.5, Release N4.2, Release N4.0

Trust: 2.52

sources: NVD: CVE-2017-6678 // JVNDB: JVNDB-2017-005145 // CNVD: CNVD-2017-16360 // BID: 99195 // VULHUB: VHN-114881

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2017-16360

AFFECTED PRODUCTS

vendor:	cisco	model:	virtualized packet core	scope:	eq	version:	v21.0_base	Trust: 1.6
vendor:	cisco	model:	virtualized packet core	scope:	eq	version:	v19.3_base	Trust: 1.6
vendor:	cisco	model:	virtualized packet core	scope:	eq	version:	v19.2_base	Trust: 1.6
vendor:	cisco	model:	virtualized packet core	scope:	eq	version:	v20.2_base	Trust: 1.6
vendor:	cisco	model:	virtualized packet core	scope:	eq	version:	v20.0_base	Trust: 1.6
vendor:	cisco	model:	virtualized packet core	scope:	eq	version:	v20.1_base	Trust: 1.6
vendor:	cisco	model:	virtualized packet core	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	virtualized packet core-distributed instance	scope:	-	version:	-	Trust: 0.6
vendor:	cisco	model:	virtualized packet core-distributed instance software n5.1	scope:	-	version:	-	Trust: 0.3
vendor:	cisco	model:	virtualized packet core-distributed instance software n5.0	scope:	-	version:	-	Trust: 0.3
vendor:	cisco	model:	virtualized packet core-distributed instance software n4.7	scope:	-	version:	-	Trust: 0.3
vendor:	cisco	model:	virtualized packet core-distributed instance software n4.6	scope:	-	version:	-	Trust: 0.3
vendor:	cisco	model:	virtualized packet core-distributed instance software n4.5	scope:	-	version:	-	Trust: 0.3
vendor:	cisco	model:	virtualized packet core-distributed instance software n4.2	scope:	-	version:	-	Trust: 0.3
vendor:	cisco	model:	virtualized packet core-distributed instance software n4.0	scope:	-	version:	-	Trust: 0.3
vendor:	cisco	model:	staros	scope:	eq	version:	21.1	Trust: 0.3
vendor:	cisco	model:	staros	scope:	eq	version:	21.0	Trust: 0.3
vendor:	cisco	model:	staros	scope:	eq	version:	20.2	Trust: 0.3
vendor:	cisco	model:	staros	scope:	eq	version:	20.1	Trust: 0.3
vendor:	cisco	model:	staros	scope:	eq	version:	20.0	Trust: 0.3
vendor:	cisco	model:	staros	scope:	eq	version:	19.3	Trust: 0.3
vendor:	cisco	model:	staros	scope:	eq	version:	19.2	Trust: 0.3
vendor:	cisco	model:	virtualized packet core-distributed instance software n4.7.2	scope:	ne	version:	-	Trust: 0.3
vendor:	cisco	model:	virtualized packet core-distributed instance software n4.2.7	scope:	ne	version:	-	Trust: 0.3
vendor:	cisco	model:	virtualized packet core-distributed instance software n4.2.6	scope:	ne	version:	-	Trust: 0.3

sources: CNVD: CNVD-2017-16360 // BID: 99195 // JVNDB: JVNDB-2017-005145 // CNNVD: CNNVD-201706-952 // NVD: CVE-2017-6678

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-6678
value:	HIGH
Trust: 1.0
NVD:	CVE-2017-6678
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2017-16360
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201706-952
value:	HIGH
Trust: 0.6
VULHUB:	VHN-114881
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2017-6678
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2017-16360
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-114881
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2017-6678
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.0
Trust: 1.8

sources: CNVD: CNVD-2017-16360 // VULHUB: VHN-114881 // JVNDB: JVNDB-2017-005145 // CNNVD: CNNVD-201706-952 // NVD: CVE-2017-6678

PROBLEMTYPE DATA

problemtype:	CWE-399	Trust: 1.9
problemtype:	CWE-755	Trust: 1.1

sources: VULHUB: VHN-114881 // JVNDB: JVNDB-2017-005145 // NVD: CVE-2017-6678

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201706-952

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-201706-952

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-005145

PATCH

title:	cisco-sa-20170621-vpc	url:	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170621-vpc	Trust: 0.8
title:	CiscoVirtualizedPacketCore-DistributedInstance denial of service vulnerability patch	url:	https://www.cnvd.org.cn/patchInfo/show/98698	Trust: 0.6
title:	Cisco Virtualized Packet Core-Distributed Instance Software Remediation of resource management error vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=74432	Trust: 0.6

sources: CNVD: CNVD-2017-16360 // JVNDB: JVNDB-2017-005145 // CNNVD: CNNVD-201706-952

EXTERNAL IDS

db:	NVD	id:	CVE-2017-6678	Trust: 3.4
db:	BID	id:	99195	Trust: 2.6
db:	JVNDB	id:	JVNDB-2017-005145	Trust: 0.8
db:	CNNVD	id:	CNNVD-201706-952	Trust: 0.7
db:	CNVD	id:	CNVD-2017-16360	Trust: 0.6
db:	VULHUB	id:	VHN-114881	Trust: 0.1

sources: CNVD: CNVD-2017-16360 // VULHUB: VHN-114881 // BID: 99195 // JVNDB: JVNDB-2017-005145 // CNNVD: CNNVD-201706-952 // NVD: CVE-2017-6678

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20170621-vpc	Trust: 2.6
url:	http://www.securityfocus.com/bid/99195	Trust: 1.7
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-6678	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2017-6678	Trust: 0.8
url:	http://www.cisco.com/	Trust: 0.3

sources: CNVD: CNVD-2017-16360 // VULHUB: VHN-114881 // BID: 99195 // JVNDB: JVNDB-2017-005145 // CNNVD: CNNVD-201706-952 // NVD: CVE-2017-6678

CREDITS

Cisco

Trust: 0.9

sources: BID: 99195 // CNNVD: CNNVD-201706-952

SOURCES

db:	CNVD	id:	CNVD-2017-16360
db:	VULHUB	id:	VHN-114881
db:	BID	id:	99195
db:	JVNDB	id:	JVNDB-2017-005145
db:	CNNVD	id:	CNNVD-201706-952
db:	NVD	id:	CVE-2017-6678

LAST UPDATE DATE

2024-11-23T22:56:12.153000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2017-16360	date:	2017-07-25T00:00:00
db:	VULHUB	id:	VHN-114881	date:	2019-10-09T00:00:00
db:	BID	id:	99195	date:	2017-06-21T00:00:00
db:	JVNDB	id:	JVNDB-2017-005145	date:	2017-07-19T00:00:00
db:	CNNVD	id:	CNNVD-201706-952	date:	2019-10-17T00:00:00
db:	NVD	id:	CVE-2017-6678	date:	2024-11-21T03:30:17.157

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2017-16360	date:	2017-07-25T00:00:00
db:	VULHUB	id:	VHN-114881	date:	2017-06-26T00:00:00
db:	BID	id:	99195	date:	2017-06-21T00:00:00
db:	JVNDB	id:	JVNDB-2017-005145	date:	2017-07-19T00:00:00
db:	CNNVD	id:	CNNVD-201706-952	date:	2017-06-21T00:00:00
db:	NVD	id:	CVE-2017-6678	date:	2017-06-26T07:29:00.247