CVE-2018-0159

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2018-0159
A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to improper validation of specific IKEv1 packets. An attacker could exploit this vulnerability by sending crafted IKEv1 packets to an affected device during an IKE negotiation. A successful exploit could allow the attacker to cause an affected device to reload, resulting in a DoS condition. Cisco Bug IDs: CSCuj73916.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

7.8 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:C

Exploitability : 10.0 / Impact : 6.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact COMPLETE

References
Link Resource
http://www.securityfocus.com/bid/103562 Broken Link Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1040595 Broken Link Third Party Advisory VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-ike-dos Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:cisco:ios:15.3\(3\)s:*:*:*:*:*:*:*
OR cpe:2.3:h:cisco:asr_901-12c-f-d:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asr_901-12c-ft-d:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asr_901-4c-f-d:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asr_901-4c-ft-d:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asr_901-6cz-f-a:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asr_901-6cz-f-d:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asr_901-6cz-ft-a:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asr_901-6cz-ft-d:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:me_3600x-24cx-m:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:me_3600x-24fs-m:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:me_3600x-24ts-m:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:me_3800x-24fs-m:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:cisco:ios_xe:15.3\(3\)s:*:*:*:*:*:*:*
OR cpe:2.3:h:cisco:asr_901-12c-f-d:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asr_901-12c-ft-d:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asr_901-4c-f-d:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asr_901-4c-ft-d:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asr_901-6cz-f-a:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asr_901-6cz-f-d:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asr_901-6cz-ft-a:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:asr_901-6cz-ft-d:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:me_3600x-24cx-m:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:me_3600x-24fs-m:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:me_3600x-24ts-m:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:me_3800x-24fs-m:-:*:*:*:*:*:*:*
History

16 Jul 2024, 17:24

Type Values Removed Values Added
CWE NVD-CWE-noinfo
References () http://www.securityfocus.com/bid/103562 - Third Party Advisory, VDB Entry () http://www.securityfocus.com/bid/103562 - Broken Link, Third Party Advisory, VDB Entry
References () http://www.securitytracker.com/id/1040595 - Third Party Advisory, VDB Entry () http://www.securitytracker.com/id/1040595 - Broken Link, Third Party Advisory, VDB Entry
Information

Published : 2018-03-28 22:29

Updated : 2024-07-16 17:24

NVD link : CVE-2018-0159

Mitre link : CVE-2018-0159

CVE.ORG link : CVE-2018-0159

JSON object : View

Products Affected

cisco

  • me_3800x-24fs-m
  • asr_901-6cz-ft-a
  • ios_xe
  • asr_901-6cz-f-a
  • asr_901-4c-f-d
  • asr_901-12c-ft-d
  • me_3600x-24ts-m
  • ios
  • asr_901-6cz-ft-d
  • asr_901-4c-ft-d
  • asr_901-6cz-f-d
  • me_3600x-24fs-m
  • asr_901-12c-f-d
  • me_3600x-24cx-m
CWE
NVD-CWE-noinfo CWE-20

Improper Input Validation