Details of VAR-201803-1608

ID

VAR-201803-1608

CVE

CVE-2018-0189

TITLE

Cisco IOS Software and Cisco IOS XE Software resource management vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2018-003434

DESCRIPTION

A vulnerability in the Forwarding Information Base (FIB) code of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, network attacker to cause a denial of service (DoS) condition. The vulnerability is due to a limitation in the way the FIB is internally representing recursive routes. An attacker could exploit this vulnerability by injecting routes into the routing protocol that have a specific recursive pattern. The attacker must be in a position on the network that provides the ability to inject a number of recursive routes with a specific pattern. An exploit could allow the attacker to cause an affected device to reload, creating a DoS condition. Cisco Bug IDs: CSCva91655. Vendors have confirmed this vulnerability Bug ID CSCva91655 It is released as.Service operation interruption (DoS) There is a possibility of being put into a state

Trust: 1.98

sources: NVD: CVE-2018-0189 // JVNDB: JVNDB-2018-003434 // BID: 103548 // VULHUB: VHN-118391

AFFECTED PRODUCTS

vendor:	cisco	model:	ios xe	scope:	lt	version:	15.2\(1\)e1	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	lt	version:	15.4\(2\)s1	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	lt	version:	15.5\(3\)s5	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	lt	version:	15.2\(2\)e1	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	lt	version:	15.2\(4\)e5	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	lt	version:	15.5\(3\)m5	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	lt	version:	15.4\(3\)s7	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	lt	version:	15.4\(1\)s1	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	lt	version:	15.4\(1\)s0a	Trust: 1.0
vendor:	cisco	model:	ios xe	scope:	lt	version:	15.2\(5\)e1	Trust: 1.0
vendor:	cisco	model:	ios	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	ios xe	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.4s_3.4.5s	Trust: 0.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.4sg.1	Trust: 0.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.4sg.4	Trust: 0.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.4s_3.4.6s	Trust: 0.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.4sg.0	Trust: 0.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.4sg.2	Trust: 0.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.4sg.3	Trust: 0.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.4s_3.4.4s	Trust: 0.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.8.2s	Trust: 0.6
vendor:	cisco	model:	ios xe	scope:	eq	version:	3.4sg	Trust: 0.6
vendor:	cisco	model:	me 3800x-24fs-m switch router	scope:	eq	version:	0	Trust: 0.3
vendor:	cisco	model:	me 3600x-24ts-m switch	scope:	eq	version:	0	Trust: 0.3
vendor:	cisco	model:	me 3600x-24fs-m switch	scope:	eq	version:	0	Trust: 0.3
vendor:	cisco	model:	me 3600x-24cx-m switch	scope:	eq	version:	0	Trust: 0.3
vendor:	cisco	model:	me 44fa-d-k9 switch	scope:	eq	version:	2600x0	Trust: 0.3
vendor:	cisco	model:	ios xe software	scope:	eq	version:	0	Trust: 0.3
vendor:	cisco	model:	ios 15.4 s	scope:	-	version:	-	Trust: 0.3
vendor:	cisco	model:	asr 901s-4sg-f-d router	scope:	eq	version:	0	Trust: 0.3
vendor:	cisco	model:	asr 901s-3sg-f-d router	scope:	eq	version:	0	Trust: 0.3
vendor:	cisco	model:	asr 901s-3sg-f-ah router	scope:	eq	version:	0	Trust: 0.3
vendor:	cisco	model:	asr 901s-2sg-f-d router	scope:	eq	version:	0	Trust: 0.3
vendor:	cisco	model:	asr 901s-2sg-f-ah router	scope:	eq	version:	0	Trust: 0.3
vendor:	cisco	model:	asr 901-6cz-ft-d router	scope:	eq	version:	0	Trust: 0.3
vendor:	cisco	model:	asr 901-6cz-ft-a router	scope:	eq	version:	0	Trust: 0.3
vendor:	cisco	model:	asr 901-6cz-fs-d router	scope:	eq	version:	0	Trust: 0.3
vendor:	cisco	model:	asr 901-6cz-fs-a router	scope:	eq	version:	0	Trust: 0.3
vendor:	cisco	model:	asr 901-6cz-f-d router	scope:	eq	version:	0	Trust: 0.3
vendor:	cisco	model:	asr 901-6cz-f-a router	scope:	eq	version:	0	Trust: 0.3
vendor:	cisco	model:	asr 901-4c-ft-d router	scope:	eq	version:	0	Trust: 0.3
vendor:	cisco	model:	asr 901-4c-f-d router	scope:	eq	version:	0	Trust: 0.3
vendor:	cisco	model:	asr 901-12c-ft-d router	scope:	eq	version:	0	Trust: 0.3
vendor:	cisco	model:	asr 901-12c-f-d router	scope:	eq	version:	0	Trust: 0.3
vendor:	cisco	model:	series supervisor engine	scope:	eq	version:	76007200	Trust: 0.3
vendor:	cisco	model:	series supervisor engine with multilayer switch feature	scope:	eq	version:	7600320	Trust: 0.3
vendor:	cisco	model:	series route switch processor	scope:	eq	version:	76007200	Trust: 0.3

sources: BID: 103548 // JVNDB: JVNDB-2018-003434 // CNNVD: CNNVD-201803-1007 // NVD: CVE-2018-0189

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2018-0189
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2018-0189
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201803-1007
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-118391
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2018-0189
severity:	HIGH
baseScore:	7.1
vectorString:	AV:N/AC:M/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-118391
severity:	HIGH
baseScore:	7.1
vectorString:	AV:N/AC:M/AU:N/C:N/I:N/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2018-0189
baseSeverity:	MEDIUM
baseScore:	5.3
vectorString:	CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	HIGH
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	1.6
impactScore:	3.6
version:	3.0
Trust: 1.8

sources: VULHUB: VHN-118391 // JVNDB: JVNDB-2018-003434 // CNNVD: CNNVD-201803-1007 // NVD: CVE-2018-0189

PROBLEMTYPE DATA

problemtype:	CWE-399	Trust: 1.9
problemtype:	NVD-CWE-noinfo	Trust: 1.0

sources: VULHUB: VHN-118391 // JVNDB: JVNDB-2018-003434 // NVD: CVE-2018-0189

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201803-1007

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-201803-1007

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-003434

PATCH

title:	cisco-sa-20180328-FIB-dos	url:	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-FIB-dos	Trust: 0.8
title:	Cisco IOS Software and IOS XE Software Remediation of resource management error vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=79475	Trust: 0.6

sources: JVNDB: JVNDB-2018-003434 // CNNVD: CNNVD-201803-1007

EXTERNAL IDS

db:	NVD	id:	CVE-2018-0189	Trust: 2.8
db:	BID	id:	103548	Trust: 2.0
db:	JVNDB	id:	JVNDB-2018-003434	Trust: 0.8
db:	CNNVD	id:	CNNVD-201803-1007	Trust: 0.7
db:	VULHUB	id:	VHN-118391	Trust: 0.1

sources: VULHUB: VHN-118391 // BID: 103548 // JVNDB: JVNDB-2018-003434 // CNNVD: CNNVD-201803-1007 // NVD: CVE-2018-0189

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20180328-fib-dos	Trust: 2.0
url:	http://www.securityfocus.com/bid/103548	Trust: 1.7
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-0189	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2018-0189	Trust: 0.8
url:	http://www.cisco.com/	Trust: 0.3

sources: VULHUB: VHN-118391 // BID: 103548 // JVNDB: JVNDB-2018-003434 // CNNVD: CNNVD-201803-1007 // NVD: CVE-2018-0189

CREDITS

The vendor reported this issue.

Trust: 0.3

sources: BID: 103548

SOURCES

db:	VULHUB	id:	VHN-118391
db:	BID	id:	103548
db:	JVNDB	id:	JVNDB-2018-003434
db:	CNNVD	id:	CNNVD-201803-1007
db:	NVD	id:	CVE-2018-0189

LAST UPDATE DATE

2024-11-23T22:48:45.639000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-118391	date:	2019-10-09T00:00:00
db:	BID	id:	103548	date:	2018-03-28T00:00:00
db:	JVNDB	id:	JVNDB-2018-003434	date:	2018-05-23T00:00:00
db:	CNNVD	id:	CNNVD-201803-1007	date:	2019-10-17T00:00:00
db:	NVD	id:	CVE-2018-0189	date:	2024-11-21T03:37:41.763

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-118391	date:	2018-03-28T00:00:00
db:	BID	id:	103548	date:	2018-03-28T00:00:00
db:	JVNDB	id:	JVNDB-2018-003434	date:	2018-05-23T00:00:00
db:	CNNVD	id:	CNNVD-201803-1007	date:	2018-03-29T00:00:00
db:	NVD	id:	CVE-2018-0189	date:	2018-03-28T22:29:02