Details of VAR-201803-1378

ID

VAR-201803-1378

CVE

CVE-2018-0159

TITLE

Cisco IOS software Cisco IOS XE Software input validation vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2018-003427

DESCRIPTION

A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to improper validation of specific IKEv1 packets. An attacker could exploit this vulnerability by sending crafted IKEv1 packets to an affected device during an IKE negotiation. A successful exploit could allow the attacker to cause an affected device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCuj73916. Cisco IOS software Cisco IOS XE The software contains an input validation vulnerability. Vendors have confirmed this vulnerability Bug ID CSCuj73916 It is released as.Service operation interruption (DoS) There is a possibility of being put into a state. The vulnerability stems from a program failing to properly verify IKEv1 packets

Trust: 2.61

sources: NVD: CVE-2018-0159 // JVNDB: JVNDB-2018-003427 // CNVD: CNVD-2018-08185 // BID: 103562 // VULHUB: VHN-118361 // VULMON: CVE-2018-0159

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2018-08185

AFFECTED PRODUCTS

vendor:	cisco	model:	ios xe	scope:	eq	version:	15.3\(3\)s	Trust: 1.6
vendor:	cisco	model:	ios	scope:	eq	version:	15.3\(3\)s	Trust: 1.6
vendor:	cisco	model:	ios xe	scope:	-	version:	-	Trust: 1.4
vendor:	cisco	model:	ios	scope:	-	version:	-	Trust: 1.4
vendor:	cisco	model:	me 3800x-24fs-m switch router	scope:	eq	version:	0	Trust: 0.3
vendor:	cisco	model:	me 3600x-24ts-m switch	scope:	eq	version:	0	Trust: 0.3
vendor:	cisco	model:	me 3600x-24fs-m switch	scope:	eq	version:	0	Trust: 0.3
vendor:	cisco	model:	me 3600x-24cx-m switch	scope:	eq	version:	0	Trust: 0.3
vendor:	cisco	model:	ios xe software	scope:	eq	version:	0	Trust: 0.3
vendor:	cisco	model:	ios 15.3 s	scope:	-	version:	-	Trust: 0.3
vendor:	cisco	model:	ios	scope:	eq	version:	0	Trust: 0.3
vendor:	cisco	model:	asr 901-6cz-ft-d router	scope:	eq	version:	0	Trust: 0.3
vendor:	cisco	model:	asr 901-6cz-ft-a router	scope:	eq	version:	0	Trust: 0.3
vendor:	cisco	model:	asr 901-6cz-f-d router	scope:	eq	version:	0	Trust: 0.3
vendor:	cisco	model:	asr 901-6cz-f-a router	scope:	eq	version:	0	Trust: 0.3
vendor:	cisco	model:	asr 901-4c-ft-d router	scope:	eq	version:	0	Trust: 0.3
vendor:	cisco	model:	asr 901-4c-f-d router	scope:	eq	version:	0	Trust: 0.3
vendor:	cisco	model:	asr 901-12c-ft-d router	scope:	eq	version:	0	Trust: 0.3
vendor:	cisco	model:	asr 901-12c-f-d router	scope:	eq	version:	0	Trust: 0.3

sources: CNVD: CNVD-2018-08185 // BID: 103562 // JVNDB: JVNDB-2018-003427 // CNNVD: CNNVD-201803-1031 // NVD: CVE-2018-0159

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2018-0159
value:	HIGH
Trust: 1.0
NVD:	CVE-2018-0159
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2018-08185
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201803-1031
value:	HIGH
Trust: 0.6
VULHUB:	VHN-118361
value:	HIGH
Trust: 0.1
VULMON:	CVE-2018-0159
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2018-0159
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
CNVD:	CNVD-2018-08185
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-118361
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2018-0159
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.1
Trust: 1.0
NVD:	CVE-2018-0159
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2018-08185 // VULHUB: VHN-118361 // VULMON: CVE-2018-0159 // JVNDB: JVNDB-2018-003427 // CNNVD: CNNVD-201803-1031 // NVD: CVE-2018-0159

PROBLEMTYPE DATA

problemtype:	CWE-20	Trust: 1.9
problemtype:	NVD-CWE-noinfo	Trust: 1.0

sources: VULHUB: VHN-118361 // JVNDB: JVNDB-2018-003427 // NVD: CVE-2018-0159

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201803-1031

TYPE

Input Validation Error

Trust: 0.9

sources: BID: 103562 // CNNVD: CNNVD-201803-1031

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-003427

PATCH

title:	cisco-sa-20180328-ike-dos	url:	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-ike-dos	Trust: 0.8
title:	Cisco IOS Software and IOSXESoftware enter patches for verification vulnerabilities	url:	https://www.cnvd.org.cn/patchInfo/show/126847	Trust: 0.6
title:	Cisco IOS Software and IOS XE Software Enter the fix for the verification vulnerability	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=79499	Trust: 0.6
title:	Cisco: Cisco IOS and IOS XE Software Internet Key Exchange Version 1 Denial of Service Vulnerability	url:	https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-20180328-ike-dos	Trust: 0.1
title:	Known Exploited Vulnerabilities Detector	url:	https://github.com/Ostorlab/KEV	Trust: 0.1

sources: CNVD: CNVD-2018-08185 // VULMON: CVE-2018-0159 // JVNDB: JVNDB-2018-003427 // CNNVD: CNNVD-201803-1031

EXTERNAL IDS

db:	NVD	id:	CVE-2018-0159	Trust: 3.5
db:	BID	id:	103562	Trust: 2.1
db:	SECTRACK	id:	1040595	Trust: 1.8
db:	JVNDB	id:	JVNDB-2018-003427	Trust: 0.8
db:	CNNVD	id:	CNNVD-201803-1031	Trust: 0.7
db:	CNVD	id:	CNVD-2018-08185	Trust: 0.6
db:	VULHUB	id:	VHN-118361	Trust: 0.1
db:	VULMON	id:	CVE-2018-0159	Trust: 0.1

sources: CNVD: CNVD-2018-08185 // VULHUB: VHN-118361 // VULMON: CVE-2018-0159 // BID: 103562 // JVNDB: JVNDB-2018-003427 // CNNVD: CNNVD-201803-1031 // NVD: CVE-2018-0159

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20180328-ike-dos	Trust: 2.8
url:	http://www.securityfocus.com/bid/103562	Trust: 1.9
url:	http://www.securitytracker.com/id/1040595	Trust: 1.8
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-0159	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2018-0159	Trust: 0.8
url:	http://www.cisco.com/	Trust: 0.3
url:	http://www.cisco.com/en/us/products/sw/iosswrel/products_ios_cisco_ios_software_category_home.html	Trust: 0.3
url:	https://cwe.mitre.org/data/definitions/20.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1
url:	https://github.com/ostorlab/kev	Trust: 0.1

sources: CNVD: CNVD-2018-08185 // VULHUB: VHN-118361 // VULMON: CVE-2018-0159 // BID: 103562 // JVNDB: JVNDB-2018-003427 // CNNVD: CNNVD-201803-1031 // NVD: CVE-2018-0159

CREDITS

Cisco

Trust: 0.3

sources: BID: 103562

SOURCES

db:	CNVD	id:	CNVD-2018-08185
db:	VULHUB	id:	VHN-118361
db:	VULMON	id:	CVE-2018-0159
db:	BID	id:	103562
db:	JVNDB	id:	JVNDB-2018-003427
db:	CNNVD	id:	CNNVD-201803-1031
db:	NVD	id:	CVE-2018-0159

LAST UPDATE DATE

2024-11-23T21:39:32.536000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2018-08185	date:	2018-04-24T00:00:00
db:	VULHUB	id:	VHN-118361	date:	2019-10-09T00:00:00
db:	VULMON	id:	CVE-2018-0159	date:	2019-10-09T00:00:00
db:	BID	id:	103562	date:	2018-03-28T00:00:00
db:	JVNDB	id:	JVNDB-2018-003427	date:	2018-05-23T00:00:00
db:	CNNVD	id:	CNNVD-201803-1031	date:	2019-10-17T00:00:00
db:	NVD	id:	CVE-2018-0159	date:	2024-11-21T03:37:38.063

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2018-08185	date:	2018-04-24T00:00:00
db:	VULHUB	id:	VHN-118361	date:	2018-03-28T00:00:00
db:	VULMON	id:	CVE-2018-0159	date:	2018-03-28T00:00:00
db:	BID	id:	103562	date:	2018-03-28T00:00:00
db:	JVNDB	id:	JVNDB-2018-003427	date:	2018-05-23T00:00:00
db:	CNNVD	id:	CNNVD-201803-1031	date:	2018-03-29T00:00:00
db:	NVD	id:	CVE-2018-0159	date:	2018-03-28T22:29:00.593