CVE-2022-20837

A vulnerability in the DNS application layer gateway (ALG) functionality that is used by Network Address Translation (NAT) in Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. This vulnerability is due to a logic error that occurs when an affected device inspects certain TCP DNS packets. An attacker could exploit this vulnerability by sending crafted DNS packets through the affected device that is performing NAT for DNS packets. A successful exploit could allow the attacker to cause the device to reload, resulting in a denial of service (DoS) condition on the affected device. Note: This vulnerability can be exploited only by sending IPv4 TCP packets through an affected device. This vulnerability cannot be exploited by sending IPv6 traffic.

CVSS v3 8.6 HIGH

8.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-alg-dos-KU9Z8kFX	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:cisco:ios_xe:-:*:*:*:*:*:*:*

OR	cpe:2.3:h:cisco:asr_1000-esp100-x:-:::::::*
	cpe:2.3:h:cisco:asr_1000-esp200-x:-:::::::*
	cpe:2.3:h:cisco:catalyst_8500:-:::::::*
	cpe:2.3:h:cisco:catalyst_8500-4qc:-:::::::*

History

No history.

Information

Published : 2022-10-10 21:15

Updated : 2024-02-28 19:29

NVD link : CVE-2022-20837

Mitre link : CVE-2022-20837

CVE.ORG link : CVE-2022-20837

JSON object : View

Products Affected

cisco

asr_1000-esp200-x
catalyst_8500-4qc
catalyst_8500
asr_1000-esp100-x
ios_xe

CWE

CWE-754

Improper Check for Unusual or Exceptional Conditions

{"id": "CVE-2022-20837", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "ykramarz@cisco.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 3.9}]}, "published": "2022-10-10T21:15:10.137", "references": [{"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-alg-dos-KU9Z8kFX", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-754"}]}, {"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-754"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the DNS application layer gateway (ALG) functionality that is used by Network Address Translation (NAT) in Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. This vulnerability is due to a logic error that occurs when an affected device inspects certain TCP DNS packets. An attacker could exploit this vulnerability by sending crafted DNS packets through the affected device that is performing NAT for DNS packets. A successful exploit could allow the attacker to cause the device to reload, resulting in a denial of service (DoS) condition on the affected device. Note: This vulnerability can be exploited only by sending IPv4 TCP packets through an affected device. This vulnerability cannot be exploited by sending IPv6 traffic."}, {"lang": "es", "value": "Una vulnerabilidad en la funcionalidad de la puerta de enlace de la capa de aplicaci\u00f3n (ALG) del DNS que usa Network Address Translation (NAT) en el software Cisco IOS XE podr\u00eda permitir a un atacante remoto no autenticado causar la recarga de un dispositivo afectado. Esta vulnerabilidad es debido a un error l\u00f3gico que es producido cuando un dispositivo afectado inspecciona determinados paquetes TCP DNS. Un atacante podr\u00eda explotar esta vulnerabilidad mediante el env\u00edo de paquetes DNS dise\u00f1ados mediante el dispositivo afectado que est\u00e1 llevando a cabo la NAT para los paquetes DNS. Una explotaci\u00f3n con \u00e9xito podr\u00eda permitir al atacante causar la recarga del dispositivo, resultando en una condici\u00f3n de negaci\u00f3n de servicio (DoS) en el dispositivo afectado. Nota: Esta vulnerabilidad s\u00f3lo puede ser explotada mediante el env\u00edo de paquetes TCP IPv4 mediante un dispositivo afectado. Esta vulnerabilidad no puede ser explotada mediante el env\u00edo de tr\u00e1fico IPv6"}], "lastModified": "2023-11-07T03:43:05.550", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cisco:ios_xe:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B7D95E8A-8F0B-44E5-B266-09E10BAAEC55"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:cisco:asr_1000-esp100-x:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "917B52DF-4210-4DD6-97EF-8A033497A954"}, {"criteria": "cpe:2.3:h:cisco:asr_1000-esp200-x:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D7F413FB-D4F9-4113-9D67-2956BF1DC30D"}, {"criteria": "cpe:2.3:h:cisco:catalyst_8500:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "7A82CE19-C3C4-4FAD-A1B3-AB91EDB61591"}, {"criteria": "cpe:2.3:h:cisco:catalyst_8500-4qc:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A1DBA393-232D-40E6-9CDB-DF82D2E7A5B6"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ykramarz@cisco.com"}