Details of VAR-201711-0309

ID

VAR-201711-0309

CVE

CVE-2017-12280

TITLE

Cisco Wireless LAN Controller Buffer error vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2017-009843

DESCRIPTION

A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) Discovery Request parsing functionality of Cisco Wireless LAN Controllers could allow an unauthenticated, remote attacker to cause an affected device to restart unexpectedly, resulting in a denial of service (DoS) condition. The vulnerability is due to incomplete input validation of fields in CAPWAP Discovery Request packets by the affected device. An attacker could exploit this vulnerability by sending crafted CAPWAP Discovery Request packets to an affected device. A successful exploit could allow the attacker to cause the affected device to restart unexpectedly, resulting in a DoS condition. Cisco Bug IDs: CSCvb95842. Cisco Wireless LAN Controller Contains a buffer error vulnerability. Vendors have confirmed this vulnerability Bug ID CSCvb95842 It is released as.Service operation interruption (DoS) There is a possibility of being put into a state. The product provides security policy, intrusion detection and other functions in the wireless LAN. A Denial of Service vulnerability exists in ControlandProvisioning of the WirelessAccessPoints (CAPWAP) DiscoveryRequest parsing feature in the WLC. Attackers can exploit this issue to cause denial-of-service conditions

Trust: 2.52

sources: NVD: CVE-2017-12280 // JVNDB: JVNDB-2017-009843 // CNVD: CNVD-2017-32923 // BID: 101646 // VULHUB: VHN-102787

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2017-32923

AFFECTED PRODUCTS

vendor:	cisco	model:	wireless lan controller software	scope:	eq	version:	-	Trust: 1.6
vendor:	cisco	model:	wireless lan controller software	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	wireless lan controller	scope:	-	version:	-	Trust: 0.6
vendor:	cisco	model:	wireless lan controllers	scope:	eq	version:	0	Trust: 0.3
vendor:	cisco	model:	series wireless controllers	scope:	eq	version:	55008.0(133.0)	Trust: 0.3
vendor:	cisco	model:	series wireless controllers	scope:	ne	version:	55008.0(150.0)	Trust: 0.3
vendor:	cisco	model:	series wireless controllers	scope:	ne	version:	55008.0(141.27)	Trust: 0.3

sources: CNVD: CNVD-2017-32923 // BID: 101646 // JVNDB: JVNDB-2017-009843 // CNNVD: CNNVD-201711-073 // NVD: CVE-2017-12280

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-12280
value:	HIGH
Trust: 1.0
NVD:	CVE-2017-12280
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2017-32923
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201711-073
value:	HIGH
Trust: 0.6
VULHUB:	VHN-102787
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2017-12280
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2017-32923
severity:	MEDIUM
baseScore:	5.4
vectorString:	AV:N/AC:H/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	HIGH
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	4.9
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-102787
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2017-12280
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.0
Trust: 1.8

sources: CNVD: CNVD-2017-32923 // VULHUB: VHN-102787 // JVNDB: JVNDB-2017-009843 // CNNVD: CNNVD-201711-073 // NVD: CVE-2017-12280

PROBLEMTYPE DATA

problemtype:

CWE-119

Trust: 1.9

sources: VULHUB: VHN-102787 // JVNDB: JVNDB-2017-009843 // NVD: CVE-2017-12280

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201711-073

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-201711-073

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-009843

PATCH

title:	cisco-sa-20171101-wlc3	url:	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171101-wlc3	Trust: 0.8
title:	Patch for Cisco WirelessLANController Denial of Service Vulnerability (CNVD-2017-32923)	url:	https://www.cnvd.org.cn/patchInfo/show/105509	Trust: 0.6
title:	Cisco Wireless LAN Controller Security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=76077	Trust: 0.6

sources: CNVD: CNVD-2017-32923 // JVNDB: JVNDB-2017-009843 // CNNVD: CNNVD-201711-073

EXTERNAL IDS

db:	NVD	id:	CVE-2017-12280	Trust: 3.4
db:	BID	id:	101646	Trust: 2.6
db:	SECTRACK	id:	1039723	Trust: 1.7
db:	JVNDB	id:	JVNDB-2017-009843	Trust: 0.8
db:	CNNVD	id:	CNNVD-201711-073	Trust: 0.7
db:	CNVD	id:	CNVD-2017-32923	Trust: 0.6
db:	VULHUB	id:	VHN-102787	Trust: 0.1

sources: CNVD: CNVD-2017-32923 // VULHUB: VHN-102787 // BID: 101646 // JVNDB: JVNDB-2017-009843 // CNNVD: CNNVD-201711-073 // NVD: CVE-2017-12280

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20171101-wlc3	Trust: 2.6
url:	http://www.securityfocus.com/bid/101646	Trust: 1.7
url:	http://www.securitytracker.com/id/1039723	Trust: 1.7
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-12280	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2017-12280	Trust: 0.8
url:	http://www.cisco.com/	Trust: 0.3
url:	http://www.cisco.com/en/us/products/ps6302/products_sub_category_home.html	Trust: 0.3

sources: CNVD: CNVD-2017-32923 // VULHUB: VHN-102787 // BID: 101646 // JVNDB: JVNDB-2017-009843 // CNNVD: CNNVD-201711-073 // NVD: CVE-2017-12280

CREDITS

Cisco

Trust: 0.3

sources: BID: 101646

SOURCES

db:	CNVD	id:	CNVD-2017-32923
db:	VULHUB	id:	VHN-102787
db:	BID	id:	101646
db:	JVNDB	id:	JVNDB-2017-009843
db:	CNNVD	id:	CNNVD-201711-073
db:	NVD	id:	CVE-2017-12280

LAST UPDATE DATE

2024-11-23T21:53:38.428000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2017-32923	date:	2017-11-07T00:00:00
db:	VULHUB	id:	VHN-102787	date:	2019-10-09T00:00:00
db:	BID	id:	101646	date:	2017-12-19T22:00:00
db:	JVNDB	id:	JVNDB-2017-009843	date:	2017-11-24T00:00:00
db:	CNNVD	id:	CNNVD-201711-073	date:	2019-10-17T00:00:00
db:	NVD	id:	CVE-2017-12280	date:	2024-11-21T03:09:13.413

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2017-32923	date:	2017-11-07T00:00:00
db:	VULHUB	id:	VHN-102787	date:	2017-11-02T00:00:00
db:	BID	id:	101646	date:	2017-11-01T00:00:00
db:	JVNDB	id:	JVNDB-2017-009843	date:	2017-11-24T00:00:00
db:	CNNVD	id:	CNNVD-201711-073	date:	2017-11-03T00:00:00
db:	NVD	id:	CVE-2017-12280	date:	2017-11-02T16:29:00.567