CVE-2018-0165: Cisco IOS XE IGMP Memory Leak Vulnerability Causing DoS

Vulnerability Title: Cisco IOS XE Software Internet Group Management Protocol Memory Leak Vulnerability Security Advisory ID: cisco-sa-20180328-igmp Initial Release Date: March 28, 2018, 16:00 GMT Version: 1.0 Workaround: No workaround is available Cisco Bug ID: CSUw09295, CSCve94496 CVSS Score: 7.4 CVE-ID: CVE-2018-0165 CWE-ID: CWE-399 Vulnerability Overview: - A vulnerability exists in the Internet Group Management Protocol (IGMP) packet processing functionality of Cisco IOS XE software, which allows an unauthenticated, adjacent attacker to exhaust buffers on the affected device, resulting in a denial-of-service (DoS) condition. - This vulnerability arises because the affected software does not adequately handle IGMP membership query packets sent to the affected device. An attacker can exploit this vulnerability by sending a large number of IGMP membership query packets containing specific values to the affected device. Successful exploitation allows the attacker to exhaust buffers on the affected device, leading to a DoS condition that requires manual reload of the device. Affected Products: - Cisco Catalyst 4500 Switches (with Supervisor Engine 8-E, if running Cisco IOS XE software version 3.x.x.E and configured with IP multicast routing) - Cisco devices running Cisco IOS XE software version 16.x (if configured with IP multicast routing) Fixed Software: Cisco has released free software updates to fix the vulnerability described in this advisory. Customers can only install and expect support for software versions and feature sets for which they have purchased licenses. Public Exploits and Announcements: Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability described in this advisory. Source: This vulnerability was discovered during the resolution of a Cisco TAC support case.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2018-0165: Cisco IOS XE IGMP Memory Leak Vulnerability Causing DoS