CVE-2018-0277

{"id": "CVE-2018-0277", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 3.9}]}, "published": "2018-05-17T03:29:00.433", "references": [{"url": "http://www.securityfocus.com/bid/104212", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securitytracker.com/id/1040922", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180516-iseeap", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securityfocus.com/bid/104212", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securitytracker.com/id/1040922", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180516-iseeap", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-295"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-295"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the Extensible Authentication Protocol-Transport Layer Security (EAP-TLS) certificate validation during EAP authentication for the Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause the ISE application server to restart unexpectedly, causing a denial of service (DoS) condition on an affected system. The vulnerability is due to incomplete input validation of the client EAP-TLS certificate. An attacker could exploit this vulnerability by initiating EAP authentication over TLS to the ISE with a crafted EAP-TLS certificate. A successful exploit could allow the attacker to restart the ISE application server, resulting in a DoS condition on the affected system. The ISE application could continue to restart while the client attempts to establish the EAP authentication connection. If an attacker attempted to import the same EAP-TLS certificate to the ISE trust store, it could trigger a DoS condition on the affected system. This exploit vector would require the attacker to have valid administrator credentials. The vulnerability affects Cisco ISE, Cisco ISE Express, and Cisco ISE Virtual Appliance. Cisco Bug IDs: CSCve31857."}, {"lang": "es", "value": "Una vulnerabilidad en la validaci\u00f3n de certificados Extensible Authentication Protocol-Transport Layer Security (EAP-TLS) durante la autenticaci\u00f3n EAP en Cisco Identity Services Engine (ISE) podr\u00eda permitir que un atacante remoto no autenticado haga que el servidor de la aplicaci\u00f3n ISE se reinicie de forma inesperada, provocando una denegaci\u00f3n de servicio (DoS) en un sistema afectado. Esta vulnerabilidad se debe a la incompleta validaci\u00f3n de entrada del certificado EAP-TLS del cliente. Un atacante podr\u00eda explotar esta vulnerabilidad iniciando la autenticaci\u00f3n EAP por TLS en el ISE con un certificado EAP-TLS manipulado. Su explotaci\u00f3n con \u00e9xito podr\u00eda permitir que el atacante reinicie el servidor de la aplicaci\u00f3n ISE, provocando una denegaci\u00f3n de servicio (DoS) en el sistema afectado. La aplicaci\u00f3n ISE podr\u00eda seguir reinici\u00e1ndose mientras el cliente intenta establecer la conexi\u00f3n de autenticaci\u00f3n EAP. Si un atacante intentase importar el mismo certificado EAP-TLS en el trust store de ISE, se desencadenar\u00eda una condici\u00f3n de denegaci\u00f3n de servicio (DoS) en el sistema afectado. El vector de explotaci\u00f3n requerir\u00eda que el atacante cuente con credenciales de administrador v\u00e1lidas. Esta vulnerabilidad afecta a Cisco ISE, Cisco ISE Express y Cisco ISE Virtual Appliance. Cisco Bug IDs: CSCve31857."}], "lastModified": "2024-11-21T03:37:52.747", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:identity_services_engine:2.0\\(0.306\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "91398750-AA2D-4D5C-9853-F39E37B6D79B"}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:2.0\\(1.130\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "177D1AD9-E72A-45A9-A5A3-1343241A397D"}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:2.1\\(0.474\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F8E53B93-2A49-4B3F-8487-E45D8F70F64C"}, {"criteria": "cpe:2.3:a:cisco:identity_services_engine:2.2\\(0.470\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DF54E8D0-76EE-40DE-A971-000C0B66A373"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}