CVE-2019-1840— Cisco Prime Network Registrar Denial of Service Vulnerability

Cisco Prime Network Registrar Denial of Service Vulnerability

A vulnerability in the DHCPv6 input packet processor of Cisco Prime Network Registrar could allow an unauthenticated, remote attacker to restart the server and cause a denial of service (DoS) condition on the affected system. The vulnerability is due to incomplete user-supplied input validation when a custom extension attempts to change a DHCPv6 packet received by the application. An attacker could exploit this vulnerability by sending malformed DHCPv6 packets to the application. An exploit could allow the attacker to trigger a restart of the service which, if exploited repeatedly, might lead to a DoS condition. This vulnerability can only be exploited if the administrator of the server has previously installed custom extensions that attempt to modify the packet details before the packet has been processed. Note: Although the CVSS score matches a High SIR, this has been lowered to Medium because this condition will only affect an application that has customer-developed extensions that will attempt to modify packet parameters before the packet has been completely sanitized. If packet modification in a custom extension happens after the packet has been sanitized, the application will not be affected by this vulnerability. Software versions prior to 8.3(7) and 9.1(2) are affected.

N/A

初始化不恰当

Cisco Prime Network Registrar 安全漏洞

Cisco Prime Network Registrar（CPNR）是美国思科（Cisco）公司的一款网络注册器产品。该产品提供了动态主机配置协议（DHCP）、域名系统（DNS）和IP地址管理（IPAM）等服务。 Cisco CPNR中的DHCPv6输入数据包处理器存在安全漏洞，该漏洞源于程序没有充分地验证用户提交的输入。远程攻击者可通过发送畸形的DHCPv6数据包利用该漏洞重启服务器，导致拒绝服务。

N/A

N/A