CVE-2018-0369

{"id": "CVE-2018-0369", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 3.9}]}, "published": "2018-07-16T17:29:00.487", "references": [{"url": "http://www.securityfocus.com/bid/104723", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180711-staros-dos", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}, {"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the reassembly logic for fragmented IPv4 packets of Cisco StarOS running on virtual platforms could allow an unauthenticated, remote attacker to trigger a reload of the npusim process, resulting in a denial of service (DoS) condition. There are four instances of the npusim process running per Service Function (SF) instance, each handling a subset of all traffic flowing across the device. It is possible to trigger a reload of all four instances of the npusim process around the same time. The vulnerability is due to improper handling of fragmented IPv4 packets containing options. An attacker could exploit this vulnerability by sending a malicious IPv4 packet across an affected device. An exploit could allow the attacker to trigger a restart of the npusim process, which will result in all traffic queued toward this instance of the npusim process to be dropped while the process is restarting. The npusim process typically restarts within less than a second. This vulnerability affects: Cisco Virtualized Packet Core-Single Instance (VPC-SI), Cisco Virtualized Packet Core-Distributed Instance (VPC-DI), Cisco Ultra Packet Core (UPC). Cisco Bug IDs: CSCvh29613."}, {"lang": "es", "value": "Una vulnerabilidad en la l\u00f3gica para paquetes IPv4 fragmentados de Cisco StarOS que se ejecuta en plataformas virtuales permite que un atacante remoto no autenticado desencadene el reinicio del proceso npusim. Esto resulta una condici\u00f3n de denegaci\u00f3n de servicio (DoS). Hay cuatro instancias del proceso npusim ejecut\u00e1ndose por instancia SF (Service Function); cada una de ellas maneja una serie de tr\u00e1fico que fluye por el dispositivo. Es posible desencadenar una recarga de las cuatro instancias del proceso npusim al mismo tiempo. La vulnerabilidad se debe a una gesti\u00f3n incorrecta de paquetes IPv4 fragmentados que contienen opciones. Un atacante podr\u00eda explotar esta vulnerabilidad enviando un paquete IPv4 malicioso a trav\u00e9s de un dispositivo afectado. Este exploit podr\u00eda permitir que el atacante desencadene el reinicio del proceso npusim, que resultar\u00e1 en que todo el tr\u00e1fico que est\u00e9 en cola hacia esta instancia del proceso npusim se dejar\u00e1 mientras el proceso se reinicia. El proceso npusim suele reiniciarse en menos de un segundo. Esta vulnerabilidad afecta a: Cisco Virtualized Packet Core-Single Instance (VPC-SI), Cisco Virtualized Packet Core-Distributed Instance (VPC-DI) y Cisco Ultra Packet Core (UPC). Cisco Bug IDs: CSCvh29613."}], "lastModified": "2019-10-09T23:31:54.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cisco:staros:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "200A4896-052D-4C31-B15D-FC9A2AE15DB3", "versionEndExcluding": "21.3.15", "versionStartIncluding": "21.3"}, {"criteria": "cpe:2.3:o:cisco:staros:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A58F3379-BB8A-43CA-87C0-8B0223E0DC12", "versionEndExcluding": "21.5.7", "versionStartIncluding": "21.4"}, {"criteria": "cpe:2.3:o:cisco:staros:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B8E5ED32-9F03-4A70-8331-2C3D4B3AD06F", "versionEndExcluding": "21.6.4", "versionStartIncluding": "21.6"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:cisco:asr_5000:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "746254AC-B039-432C-AA5C-A82260E57AD7"}, {"criteria": "cpe:2.3:h:cisco:asr_5500:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "301681DF-2A9E-4A91-9918-4A46153ADC01"}, {"criteria": "cpe:2.3:h:cisco:asr_5700:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A9EF0299-16A7-446D-855D-BFF91EE65534"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ykramarz@cisco.com"}