CVE-2017-12238

Опубликовано: 29 сент. 2017

Источник: nvd

CVSS3: 6.5

CVSS2: 3.3

EPSS Низкий

Описание

A vulnerability in the Virtual Private LAN Service (VPLS) code of Cisco IOS 15.0 through 15.4 for Cisco Catalyst 6800 Series Switches could allow an unauthenticated, adjacent attacker to cause a C6800-16P10G or C6800-16P10G-XL type line card to crash, resulting in a denial of service (DoS) condition. The vulnerability is due to a memory management issue in the affected software. An attacker could exploit this vulnerability by creating a large number of VPLS-generated MAC entries in the MAC address table of an affected device. A successful exploit could allow the attacker to cause a C6800-16P10G or C6800-16P10G-XL type line card to crash, resulting in a DoS condition. This vulnerability affects Cisco Catalyst 6800 Series Switches that are running a vulnerable release of Cisco IOS Software and have a Cisco C6800-16P10G or C6800-16P10G-XL line card in use with Supervisor Engine 6T. To be vulnerable, the device must also be configured with VPLS and the C6800-16P10G or C6800-16P10G-XL line

Ссылки

http://www.securityfocus.com/bid/101040
Broken Link
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1039453
Broken Link
Third Party Advisory
VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-vpls
Vendor Advisory
http://www.securityfocus.com/bid/101040
Broken Link
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1039453
Broken Link
Third Party Advisory
VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-vpls
Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-12238

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:cisco:ios:*:*:*:*:*:*:*:*

Версия от 15.0 (включая) до 15.4 (включая)

Одно из

cpe:2.3:h:cisco:c6800-16p10g:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:c6800-16p10g-xl:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:catalyst_6000:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:catalyst_6000_ws-svc-nam-1:2.2\(1a\):*:*:*:*:*:*:*

cpe:2.3:h:cisco:catalyst_6000_ws-svc-nam-1:3.1\(1a\):*:*:*:*:*:*:*

cpe:2.3:h:cisco:catalyst_6000_ws-svc-nam-2:2.2\(1a\):*:*:*:*:*:*:*

cpe:2.3:h:cisco:catalyst_6000_ws-svc-nam-2:3.1\(1a\):*:*:*:*:*:*:*

cpe:2.3:h:cisco:catalyst_6000_ws-x6380-nam:2.1\(2\):*:*:*:*:*:*:*

cpe:2.3:h:cisco:catalyst_6000_ws-x6380-nam:3.1\(1a\):*:*:*:*:*:*:*

cpe:2.3:h:cisco:catalyst_6500:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:catalyst_6500-e:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:catalyst_6500_ws-svc-nam-1:2.2\(1a\):*:*:*:*:*:*:*

cpe:2.3:h:cisco:catalyst_6500_ws-svc-nam-1:3.1\(1a\):*:*:*:*:*:*:*

cpe:2.3:h:cisco:catalyst_6500_ws-svc-nam-2:2.2\(1a\):*:*:*:*:*:*:*

cpe:2.3:h:cisco:catalyst_6500_ws-svc-nam-2:3.1\(1a\):*:*:*:*:*:*:*

cpe:2.3:h:cisco:catalyst_6500_ws-x6380-nam:2.1\(2\):*:*:*:*:*:*:*

cpe:2.3:h:cisco:catalyst_6500_ws-x6380-nam:3.1\(1a\):*:*:*:*:*:*:*

cpe:2.3:h:cisco:catalyst_6503-e:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:catalyst_6504-e:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:catalyst_6506-e:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:catalyst_6509-e:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:catalyst_6509-neb-a:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:catalyst_6509-v-e:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:catalyst_6513:-:*:*:*:*:*:*:*

cpe:2.3:h:cisco:catalyst_6513-e:-:*:*:*:*:*:*:*

EPSS

Процентиль: 78%

0.01154

Низкий

6.5 Medium

CVSS3

3.3 Low

CVSS2

Дефекты

CWE-399

NVD-CWE-noinfo

Связанные уязвимости

GHSA-g8w4-jc9x-6qpc

CVSS3: 6.5

github

больше 3 лет назад

BDU:2022-04013

CVSS3: 6.5

fstec

больше 8 лет назад

Уязвимость реализации VPLS операционной системы Cisco IOS коммутаторов Cisco Catalyst серии 6800, позволяющая нарушителю вызвать отказ в обслуживании

EPSS

Процентиль: 78%

0.01154

Низкий

6.5 Medium

CVSS3

3.3 Low

CVSS2

Дефекты

CWE-399

NVD-CWE-noinfo