—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1

Cisco Security Advisory: Cisco IOS and IOS XE Software Cluster Management Protocol Denial of Service Vulnerability

Advisory ID: cisco-sa-20180926-cmp

Revision: 1.0

For Public Release: 2018 September 26 16:00 GMT

Last Updated: 2018 September 26 16:00 GMT

CVE ID(s): CVE-2018-0475

CVSS Score v(3): 7.4 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

+———————————————————————

Summary

=======

A vulnerability in the implementation of the cluster feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to trigger a denial of service (DoS) condition on an affected device.

The vulnerability is due to improper input validation when handling Cluster Management Protocol (CMP) messages. An attacker could exploit this vulnerability by sending a malicious CMP message to an affected device. A successful exploit could allow the attacker to cause the switch to crash and reload or to hang, resulting in a DoS condition. If the switch hangs it will not reboot automatically, and it will need to be power cycled manually to recover.

Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability.

This advisory is available at the following link:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-cmp [“https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-cmp”]

This advisory is part of the September 26, 2018, release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication, which includes 12 Cisco Security Advisories that describe 13 vulnerabilities. For a complete list of the advisories and links to them, see Cisco Event Response: September 2018 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication [“http://tools.cisco.com/security/center/viewErp.x?alertId=ERP-69981”].

—–BEGIN PGP SIGNATURE—–

iQJ5BAEBAgBjBQJbq67jXBxDaXNjbyBQcm9kdWN0IFNlY3VyaXR5IEluY2lkZW50
IFJlc3BvbnNlIFRlYW0gKENpc2NvIFBTSVJUIGtleSAyMDE4LTIwMTkpIDxwc2ly
dEBjaXNjby5jb20+AAoJEJa12PPJBfcz8zMQAI09Se5r1EQmLWwWnm3EXfLDwILf
YwnxnQMv4nM2h7dnEqD5U6Hs2/p4eCYXVEouCLJk0afzPAf6Z9hH1OjtFECpMr/t
aloCZ0+MMIo3I/ZcC9MRwS4m2gsZReH2e0Bs+seWnxCnRRgLaznw5mj0yxAEmo4O
LvRZQNFJx1Ku1PN2ZfBZOpv5p6XEIF2dCS1TtLCCZclzhbClP3tz9K/2gm6Ukx7b
to1AC9CKdNxrT/mN4ON4QyTLNY12iPzb/LDwgtzXiqfgNREDD0CPQDZljHQ0GJ++
kTAuegMqCchwoY0p+Ebly7mGr84t5IZKvFi3UxwjEE/HEKxok3e7gjDwHDLw8fol
Hkmqy630Mkdrc52qe9QRgODvoeXE3SXuF7LRVK6rCNUYa0FLhLFVIpR7CLnp4Tqc
IK4qJy1dio8jzRDl+S/wnM3tU7MV3PnmGRtVH9LO7Q4EJsl29sG76FT8dKxcOScP
ZFc7Wu5Pnu2lI97LujYvgYaRseRuO0qMkB5VsBEBBxdSuIWGPbnzk//vcOybpC6c
UMHYan9DoANvYd6CLXUvVf8Dp25CIoPr3lST/W0dp761i/HtLyK+BiWeL6oFxgff
kRODG/PLC6GkruMwLF/KkMn7ZMvRJBwOnjKTwbbQv0OFXEKoWYPt0nanNUETLvRF
AuJNtzErkDZD69gP
=ZSAn
—–END PGP SIGNATURE—–

_______________________________________________
cust-security-announce mailing list
cust-security-announce@cisco.com
To unsubscribe, send the command “unsubscribe” in the subject of your message to cust-security-announce-leave@cisco.com