Details of VAR-201803-1390

ID

VAR-201803-1390

CVE

CVE-2018-0174

TITLE

Cisco IOS Software and Cisco IOS XE Software input validation vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2018-003511

DESCRIPTION

A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability exists because the affected software performs incomplete input validation of option 82 information that it receives in DHCP Version 4 (DHCPv4) packets from DHCP relay agents. An attacker could exploit this vulnerability by sending a crafted DHCPv4 packet to an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCuh91645. Vendors have confirmed this vulnerability Bug ID CSCuh91645 It is released as.Service operation interruption (DoS) There is a possibility of being put into a state. The vulnerability is caused by the fact that the program does not perform complete input verification on option 82 information

Trust: 2.07

sources: NVD: CVE-2018-0174 // JVNDB: JVNDB-2018-003511 // BID: 103554 // VULHUB: VHN-118376 // VULMON: CVE-2018-0174

AFFECTED PRODUCTS

vendor:	cisco	model:	ios	scope:	eq	version:	12.2\(33\)sre7a	Trust: 1.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	12.2\(33\)sre7a	Trust: 1.6
vendor:	cisco	model:	ios	scope:	lte	version:	15.2\(4a\)ea5	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	lte	version:	15.2\(4a\)ea5	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	lte	version:	15.2\(6\)e0a	Trust: 1.0
vendor:	cisco	model:	ios	scope:	lte	version:	15.2\(6\)e0a	Trust: 1.0
vendor:	cisco	model:	ios	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	ios xe	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	service application module for ip	scope:	eq	version:	0	Trust: 0.3
vendor:	cisco	model:	ios xe software	scope:	eq	version:	0	Trust: 0.3
vendor:	cisco	model:	ios	scope:	eq	version:	0	Trust: 0.3
vendor:	cisco	model:	series supervisor engine with multilayer switch feature	scope:	eq	version:	7600320	Trust: 0.3
vendor:	cisco	model:	series route switch processor	scope:	eq	version:	76007200	Trust: 0.3

sources: BID: 103554 // JVNDB: JVNDB-2018-003511 // CNNVD: CNNVD-201803-1019 // NVD: CVE-2018-0174

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2018-0174
value:	HIGH
Trust: 1.0
NVD:	CVE-2018-0174
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201803-1019
value:	HIGH
Trust: 0.6
VULHUB:	VHN-118376
value:	HIGH
Trust: 0.1
VULMON:	CVE-2018-0174
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2018-0174
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
VULHUB:	VHN-118376
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2018-0174
baseSeverity:	HIGH
baseScore:	8.6
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	4.0
version:	3.1
Trust: 1.0
NVD:	CVE-2018-0174
baseSeverity:	HIGH
baseScore:	8.6
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULHUB: VHN-118376 // VULMON: CVE-2018-0174 // JVNDB: JVNDB-2018-003511 // CNNVD: CNNVD-201803-1019 // NVD: CVE-2018-0174

PROBLEMTYPE DATA

problemtype:

CWE-20

Trust: 1.9

sources: VULHUB: VHN-118376 // JVNDB: JVNDB-2018-003511 // NVD: CVE-2018-0174

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201803-1019

TYPE

Input Validation Error

Trust: 0.9

sources: BID: 103554 // CNNVD: CNNVD-201803-1019

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-003511

PATCH

title:	cisco-sa-20180328-dhcpr3	url:	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-dhcpr3	Trust: 0.8
title:	Cisco IOS Software and IOS XE Software Enter the fix for the verification vulnerability	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=79487	Trust: 0.6
title:	Cisco: Cisco IOS and IOS XE Software DHCP Version 4 Relay Denial of Service Vulnerability	url:	https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-20180328-dhcpr3	Trust: 0.1
title:	Known Exploited Vulnerabilities Detector	url:	https://github.com/Ostorlab/KEV	Trust: 0.1

sources: VULMON: CVE-2018-0174 // JVNDB: JVNDB-2018-003511 // CNNVD: CNNVD-201803-1019

EXTERNAL IDS

db:	NVD	id:	CVE-2018-0174	Trust: 2.9
db:	ICS CERT	id:	ICSA-18-107-04	Trust: 2.6
db:	ICS CERT	id:	ICSA-18-107-05	Trust: 2.6
db:	BID	id:	103554	Trust: 2.1
db:	SECTRACK	id:	1040591	Trust: 1.8
db:	TENABLE	id:	TRA-2018-06	Trust: 1.8
db:	JVNDB	id:	JVNDB-2018-003511	Trust: 0.8
db:	CNNVD	id:	CNNVD-201803-1019	Trust: 0.6
db:	VULHUB	id:	VHN-118376	Trust: 0.1
db:	VULMON	id:	CVE-2018-0174	Trust: 0.1

sources: VULHUB: VHN-118376 // VULMON: CVE-2018-0174 // BID: 103554 // JVNDB: JVNDB-2018-003511 // CNNVD: CNNVD-201803-1019 // NVD: CVE-2018-0174

REFERENCES

url:	https://ics-cert.us-cert.gov/advisories/icsa-18-107-05	Trust: 2.7
url:	https://ics-cert.us-cert.gov/advisories/icsa-18-107-04	Trust: 2.6
url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20180328-dhcpr3	Trust: 2.2
url:	http://www.securityfocus.com/bid/103554	Trust: 1.9
url:	https://www.tenable.com/security/research/tra-2018-06	Trust: 1.8
url:	http://www.securitytracker.com/id/1040591	Trust: 1.8
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-0174	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2018-0174	Trust: 0.8
url:	http://www.cisco.com/	Trust: 0.3
url:	https://cwe.mitre.org/data/definitions/20.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1
url:	https://github.com/ostorlab/kev	Trust: 0.1

sources: VULHUB: VHN-118376 // VULMON: CVE-2018-0174 // BID: 103554 // JVNDB: JVNDB-2018-003511 // CNNVD: CNNVD-201803-1019 // NVD: CVE-2018-0174

CREDITS

Tenable

Trust: 0.3

sources: BID: 103554

SOURCES

db:	VULHUB	id:	VHN-118376
db:	VULMON	id:	CVE-2018-0174
db:	BID	id:	103554
db:	JVNDB	id:	JVNDB-2018-003511
db:	CNNVD	id:	CNNVD-201803-1019
db:	NVD	id:	CVE-2018-0174

LAST UPDATE DATE

2024-11-23T21:39:32.413000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-118376	date:	2019-10-09T00:00:00
db:	VULMON	id:	CVE-2018-0174	date:	2019-10-09T00:00:00
db:	BID	id:	103554	date:	2018-03-28T00:00:00
db:	JVNDB	id:	JVNDB-2018-003511	date:	2018-05-25T00:00:00
db:	CNNVD	id:	CNNVD-201803-1019	date:	2019-10-17T00:00:00
db:	NVD	id:	CVE-2018-0174	date:	2024-11-21T03:37:39.727

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-118376	date:	2018-03-28T00:00:00
db:	VULMON	id:	CVE-2018-0174	date:	2018-03-28T00:00:00
db:	BID	id:	103554	date:	2018-03-28T00:00:00
db:	JVNDB	id:	JVNDB-2018-003511	date:	2018-05-25T00:00:00
db:	CNNVD	id:	CNNVD-201803-1019	date:	2018-03-29T00:00:00
db:	NVD	id:	CVE-2018-0174	date:	2018-03-28T22:29:01.233