Sign-up

ID

VAR-201810-0347


CVE

CVE-2018-0476


TITLE

Cisco IOS XE Software resource management vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2018-013262

DESCRIPTION

A vulnerability in the Network Address Translation (NAT) Session Initiation Protocol (SIP) Application Layer Gateway (ALG) of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. The vulnerability is due to improper processing of SIP packets in transit while NAT is performed on an affected device. An unauthenticated, remote attacker could exploit this vulnerability by sending crafted SIP packets via UDP port 5060 through an affected device that is performing NAT for SIP packets. A successful exploit could allow an attacker to cause the device to reload, resulting in a denial of service (DoS) condition. Cisco IOS XE The software contains a resource management vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. Cisco IOSXESoftware is a set of operating systems developed by Cisco for its network devices. NetworkAddressTranslation(NAT)SessionInitiationProtocol(SP)ApplicationLayerGateway(ALG) is one of the gateway components

Trust: 2.52

sources: NVD: CVE-2018-0476 // JVNDB: JVNDB-2018-013262 // CNVD: CNVD-2018-20259 // BID: 105419 // VULHUB: VHN-118678

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2018-20259

AFFECTED PRODUCTS

vendor:ciscomodel:ios xescope:eqversion:15.5\(3\)s5.1

Trust: 1.6

vendor:ciscomodel:ios xescope:eqversion:16.6.2

Trust: 1.6

vendor:ciscomodel:ios xescope:eqversion:15.5\(3\)s6.1

Trust: 1.6

vendor:ciscomodel:ios xescope: - version: -

Trust: 0.8

vendor:ciscomodel:ios xe softwarescope: - version: -

Trust: 0.6

vendor:ciscomodel:ios xe softwarescope:eqversion:16.6.2

Trust: 0.3

vendor:ciscomodel:ios xe software 15.5 s6.1scope: - version: -

Trust: 0.3

vendor:ciscomodel:ios xe software 15.5 s5.1scope: - version: -

Trust: 0.3

vendor:ciscomodel:ios xe softwarescope:eqversion:0

Trust: 0.3

sources: CNVD: CNVD-2018-20259 // BID: 105419 // JVNDB: JVNDB-2018-013262 // CNNVD: CNNVD-201809-1254 // NVD: CVE-2018-0476

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-0476
value: MEDIUM

Trust: 1.0

NVD: CVE-2018-0476
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2018-20259
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201809-1254
value: MEDIUM

Trust: 0.6

VULHUB: VHN-118678
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2018-0476
severity: HIGH
baseScore: 7.1
vectorString: AV:N/AC:M/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2018-20259
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-118678
severity: HIGH
baseScore: 7.1
vectorString: AV:N/AC:M/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2018-0476
baseSeverity: MEDIUM
baseScore: 5.9
vectorString: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 2.2
impactScore: 3.6
version: 3.0

Trust: 1.8

sources: CNVD: CNVD-2018-20259 // VULHUB: VHN-118678 // JVNDB: JVNDB-2018-013262 // CNNVD: CNNVD-201809-1254 // NVD: CVE-2018-0476

PROBLEMTYPE DATA

problemtype:CWE-399

Trust: 1.8

problemtype:NVD-CWE-noinfo

Trust: 1.0

sources: JVNDB: JVNDB-2018-013262 // NVD: CVE-2018-0476

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201809-1254

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-201809-1254

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-013262

PATCH
title:cisco-sa-20180926-sip-algurl:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-sip-alg
Trust: 0.8
title:Patch for CiscoIOSXESoftwareNATSIPALG Denial of Service Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/141455
Trust: 0.6
title:Cisco IOS XE Software NAT SIP ALG Remediation of resource management error vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=85263
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2018-20259 // 
            
            
            
            JVNDB: JVNDB-2018-013262 // 
            
            
            
            CNNVD: CNNVD-201809-1254

EXTERNAL IDS
db:NVDid:CVE-2018-0476
Trust: 3.4
db:BIDid:105419
Trust: 2.0
db:SECTRACKid:1041737
Trust: 1.7
db:SECTRACKid:1041734
Trust: 1.7
db:JVNDBid:JVNDB-2018-013262
Trust: 0.8
db:CNNVDid:CNNVD-201809-1254
Trust: 0.7
db:CNVDid:CNVD-2018-20259
Trust: 0.6
db:VULHUBid:VHN-118678
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2018-20259 // 
            
            
            
            VULHUB: VHN-118678 // 
            
            
            
            BID: 105419 // 
            
            
            
            JVNDB: JVNDB-2018-013262 // 
            
            
            
            CNNVD: CNNVD-201809-1254 // 
            
            
            
            NVD: CVE-2018-0476

REFERENCES
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20180926-sip-alg
Trust: 2.6
url:http://www.securityfocus.com/bid/105419
Trust: 1.7
url:http://www.securitytracker.com/id/1041734
Trust: 1.7
url:http://www.securitytracker.com/id/1041737
Trust: 1.7
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-0476
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2018-0476
Trust: 0.8
url:http://www.cisco.com/
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2018-20259 // 
            
            
            
            VULHUB: VHN-118678 // 
            
            
            
            BID: 105419 // 
            
            
            
            JVNDB: JVNDB-2018-013262 // 
            
            
            
            CNNVD: CNNVD-201809-1254 // 
            
            
            
            NVD: CVE-2018-0476

CREDITS
The vendor reported this issue.
Trust: 0.3
sources:
            
            
            BID: 105419

SOURCES
db:CNVDid:CNVD-2018-20259
db:VULHUBid:VHN-118678
db:BIDid:105419
db:JVNDBid:JVNDB-2018-013262
db:CNNVDid:CNNVD-201809-1254
db:NVDid:CVE-2018-0476

LAST UPDATE DATE
2024-08-14T13:45:33.006000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2018-20259date:2018-09-30T00:00:00
db:VULHUBid:VHN-118678date:2019-10-09T00:00:00
db:BIDid:105419date:2018-09-26T00:00:00
db:JVNDBid:JVNDB-2018-013262date:2019-02-18T00:00:00
db:CNNVDid:CNNVD-201809-1254date:2019-10-17T00:00:00
db:NVDid:CVE-2018-0476date:2019-10-09T23:32:10.130

SOURCES RELEASE DATE
db:CNVDid:CNVD-2018-20259date:2018-09-30T00:00:00
db:VULHUBid:VHN-118678date:2018-10-05T00:00:00
db:BIDid:105419date:2018-09-26T00:00:00
db:JVNDBid:JVNDB-2018-013262date:2019-02-18T00:00:00
db:CNNVDid:CNNVD-201809-1254date:2018-09-28T00:00:00
db:NVDid:CVE-2018-0476date:2018-10-05T14:29:05.357