Vulnerabilities > CVE-2016-1349 - Resource Management Errors vulnerability in multiple products
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
NONE Integrity impact
NONE Availability impact
HIGH Summary
The Smart Install client implementation in Cisco IOS 12.2, 15.0, and 15.2 and IOS XE 3.2 through 3.7 allows remote attackers to cause a denial of service (device reload) via crafted image list parameters in a Smart Install packet, aka Bug ID CSCuv45410.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Nessus
NASL family CISCO NASL id CISCO-SA-20160323-SMI-IOSXE.NASL description According to its self-reported version, the Cisco IOS XE software running on the remote device is affected by a denial of service vulnerability in the Smart Install client feature due to improper handling of image list parameters. An unauthenticated, remote attacker can exploit this issue, via crafted Smart Install packets, to cause the device to reload. last seen 2020-06-01 modified 2020-06-02 plugin id 90359 published 2016-04-06 reporter This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/90359 title Cisco IOS XE Smart Install Packet Image List Parameter Handling DoS (cisco-sa-20160323-smi) code #TRUSTED 216d71255f09d0718cefd9639207bba566647e2389d255274073c53fd4e966df19011ad2783807ff910222fef45b929edb72e321c61caf1f1b57b71f3692828b90089aa04820e15f88cd733bef1d2bfc5e44e549e4754c16ca1900046cb27028ac092f716b89ae185d3872a8284ff981bd64ee5d6bc071611fb0f67f9529181bbbd300bd9464c5fe20b1411713704074b2b8397cdb8f55a176b76ecc6d4f7105f9adc1f274fc4eeb43821ed3600bc1e0bab97046de247274af49b5bd52b9feb636d8101aef0cb67f3b46e3595eaacb138e00f1652499976dfd9240d6a390f68116fd410d64d1198e48cad4c9be77348e094e16ee24960bde887f2834dba3b55a30501c2e2bfc6f3d4ff9c92fe7d32c564fc0c0724921c07a7d8568766ee0c17fe88dff73ad27d7455a6627bee507b7e6826a7eec24b810f1e133f655c16f075c0f72425419d388fa186c6fbcbbd55f52f015c77937dccf7a966d5ba79a540ae3e3cd9145589762e7d05294ffc02d30ecf594e91867daf05225f16af72312bfdb12611e423f5389fa74c904e4bace23df002a4979d587e0b3e7d6b55d0ba65c03fde30fd0d5bbe21f7f6232e599e5ac25c8a92d970b62d2df782d6df1156d8f06b07078e391618cec8248fb0e440b357807a497f8b09ba87c39e774998e87a985563ee1308842c016072271812a1dab99aa16187abbbb8e01d2be35ded02ae878 # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(90359); script_version("1.11"); script_cvs_date("Date: 2019/11/20"); script_cve_id("CVE-2016-1349"); script_xref(name:"TRA", value:"TRA-2016-04"); script_xref(name:"CISCO-BUG-ID", value:"CSCuv45410"); script_xref(name:"CISCO-SA", value:"cisco-sa-20160323-smi"); script_name(english:"Cisco IOS XE Smart Install Packet Image List Parameter Handling DoS (cisco-sa-20160323-smi)"); script_summary(english:"Checks the IOS XE version."); script_set_attribute(attribute:"synopsis", value: "The remote device is missing a vendor-supplied security patch."); script_set_attribute(attribute:"description", value: "According to its self-reported version, the Cisco IOS XE software running on the remote device is affected by a denial of service vulnerability in the Smart Install client feature due to improper handling of image list parameters. An unauthenticated, remote attacker can exploit this issue, via crafted Smart Install packets, to cause the device to reload."); # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160323-smi script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?14b003f9"); script_set_attribute(attribute:"see_also", value:"https://www.tenable.com/security/research/tra-2016-04"); script_set_attribute(attribute:"solution", value: "Upgrade to the relevant fixed version referenced in Cisco bug ID CSCuv45410. Alternatively, disable the Smart Install feature per the vendor advisory."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-1349"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"vuln_publication_date", value:"2016/03/23"); script_set_attribute(attribute:"patch_publication_date", value:"2016/03/23"); script_set_attribute(attribute:"plugin_publication_date", value:"2016/04/06"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ios_xe"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"CISCO"); script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("cisco_ios_xe_version.nasl"); script_require_keys("Host/Cisco/IOS-XE/Version"); exit(0); } include("audit.inc"); include("cisco_func.inc"); include("cisco_kb_cmd_func.inc"); ver = get_kb_item_or_exit("Host/Cisco/IOS-XE/Version"); flag = 0; override = 0; # Check for vuln version if ( ver == '3.2.0JA' ) flag++; if ( ver == '3.2.0SE' ) flag++; if ( ver == '3.2.1SE' ) flag++; if ( ver == '3.2.2SE' ) flag++; if ( ver == '3.2.3SE' ) flag++; if ( ver == '3.3.0SE' ) flag++; if ( ver == '3.3.1SE' ) flag++; if ( ver == '3.3.2SE' ) flag++; if ( ver == '3.3.3SE' ) flag++; if ( ver == '3.3.4SE' ) flag++; if ( ver == '3.3.5SE' ) flag++; if ( ver == '3.3.0XO' ) flag++; if ( ver == '3.3.1XO' ) flag++; if ( ver == '3.3.2XO' ) flag++; if ( ver == '3.4.0SG' ) flag++; if ( ver == '3.4.1SG' ) flag++; if ( ver == '3.4.2SG' ) flag++; if ( ver == '3.4.3SG' ) flag++; if ( ver == '3.4.4SG' ) flag++; if ( ver == '3.4.5SG' ) flag++; if ( ver == '3.4.6SG' ) flag++; if ( ver == '3.5.0E' ) flag++; if ( ver == '3.5.1E' ) flag++; if ( ver == '3.5.2E' ) flag++; if ( ver == '3.5.3E' ) flag++; if ( ver == '3.6.0E' ) flag++; if ( ver == '3.6.1E' ) flag++; if ( ver == '3.6.2aE' ) flag++; if ( ver == '3.6.2E' ) flag++; if ( ver == '3.7.0E' ) flag++; if ( ver == '3.7.1E' ) flag++; if ( ver == '3.7.2E' ) flag++; # Check for Smart Install client feature if (flag && get_kb_item("Host/local_checks_enabled")) { flag = 0; buf = cisco_command_kb_item("Host/Cisco/Config/show_vstack_config", "show vstack config"); if (check_cisco_result(buf)) { if ( (preg(multiline:TRUE, pattern:"Role:\s*[Cc]lient", string:buf)) && (!preg(multiline:TRUE, pattern:"Role:\s*[Cc]lient\s+\(SmartInstall disabled\)", string:buf)) ) { flag = 1; } } else if (cisco_needs_enable(buf)) { flag = 1; override = 1; } } if (flag) { if (report_verbosity > 0) { report = '\n Cisco bug ID : CSCuv45410' + '\n Installed release : ' + ver + '\n'; security_hole(port:0, extra:report + cisco_caveat(override)); exit(0); } else security_hole(port:0, extra:cisco_caveat(override)); } else audit(AUDIT_HOST_NOT, "affected");NASL family CISCO NASL id CISCO-SA-20160323-SMI-IOS.NASL description According to its self-reported version, the Cisco IOS software running on the remote device is affected by a denial of service vulnerability in the Smart Install client feature due to improper handling of image list parameters. An unauthenticated, remote attacker can exploit this issue, via crafted Smart Install packets, to cause the device to reload. last seen 2020-06-01 modified 2020-06-02 plugin id 90358 published 2016-04-06 reporter This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/90358 title Cisco IOS Smart Install Packet Image List Parameter Handling DoS (cisco-sa-20160323-smi) code #TRUSTED 0102e7ade2f7d80ac14c4280273b80883994a354aedc4ec8579a7339a39191bbe7af40281fa5dfd528b6e066b6a0fab2fd315d501ce9398640392d0ff98c4d939c32846f9fe9a41595443b2f7aa69d97cd8ec52f83e4e9ba478de0d241f00215c7d86fb91327a0aaf3bdcdc0f475fa974b63e5d9b9cc037b987d7640ca5211dc8a3697a2b054aa446754611fa85e6d4c60f8d4c9ce05736a210be9792dce87d356e262cc154c65ee0c3df9e8f2632cf38192bb3c90c68ce331e3f5796fe4428f04809a95d78e986c30a6ce31bf6a05cb55184ec6fd6b96412f360e2fa37b2ff996cc91d9805d857fd8c395e2b315659352b057ce5da7474c0926a9a5810728268b7dcd6c6478fecb95d7174f2f12b3589560c98a058d4406fc2d7a36b38fccc950a4983b538df117981a80755319527f99159a89261b6139945b53ec567907c388d5bba4d89a927d69cf2f661c381dbd7e86720ed3a9c848ac1a0fc5abb0cf1839c4d341dc0398af11325ae3ff0a3ccc0c0aa86f4142204ffd5880fa6247643e86d0e975faec305b3c51aa95dab98c9d78ef1a1e1a255bb3efc25d86f83f57a73f37abb30fc4c64d986615ad42c84df320068284a3d1f6e8f5e71235993ca9b98b842958e4cda5929512d580df1704526121cd6c45d84628d52f20d0cb7b922de0f1ca08dc679590e48dde68ef097c32e4d5867c07f6e8ba6ac4d18fe20d9b42 # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(90358); script_version("1.12"); script_cvs_date("Date: 2019/11/20"); script_cve_id("CVE-2016-1349"); script_xref(name:"TRA", value:"TRA-2016-04"); script_xref(name:"CISCO-BUG-ID", value:"CSCuv45410"); script_xref(name:"CISCO-SA", value:"cisco-sa-20160323-smi"); script_name(english:"Cisco IOS Smart Install Packet Image List Parameter Handling DoS (cisco-sa-20160323-smi)"); script_summary(english:"Checks the IOS version."); script_set_attribute(attribute:"synopsis", value: "The remote device is missing a vendor-supplied security patch."); script_set_attribute(attribute:"description", value: "According to its self-reported version, the Cisco IOS software running on the remote device is affected by a denial of service vulnerability in the Smart Install client feature due to improper handling of image list parameters. An unauthenticated, remote attacker can exploit this issue, via crafted Smart Install packets, to cause the device to reload."); # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160323-smi script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?14b003f9"); script_set_attribute(attribute:"see_also", value:"https://www.tenable.com/security/research/tra-2016-04"); script_set_attribute(attribute:"solution", value: "Upgrade to the relevant fixed version referenced in Cisco bug ID CSCuv45410. Alternatively, disable the Smart Install feature per the vendor advisory."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-1349"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"vuln_publication_date", value:"2016/03/23"); script_set_attribute(attribute:"patch_publication_date", value:"2016/03/23"); script_set_attribute(attribute:"plugin_publication_date", value:"2016/04/06"); script_set_attribute(attribute:"plugin_type", value:"combined"); script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ios"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"CISCO"); script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("cisco_ios_version.nasl"); script_require_keys("Host/Cisco/IOS/Version"); exit(0); } include("audit.inc"); include("cisco_func.inc"); include("cisco_kb_cmd_func.inc"); flag = 0; override = 0; ver = get_kb_item_or_exit("Host/Cisco/IOS/Version"); # Check for vuln version if ( ver == '12.2(35)EX' ) flag++; if ( ver == '12.2(35)EX1' ) flag++; if ( ver == '12.2(35)EX2' ) flag++; if ( ver == '12.2(37)EX' ) flag++; if ( ver == '12.2(40)EX' ) flag++; if ( ver == '12.2(40)EX1' ) flag++; if ( ver == '12.2(40)EX2' ) flag++; if ( ver == '12.2(40)EX3' ) flag++; if ( ver == '12.2(44)EX' ) flag++; if ( ver == '12.2(44)EX1' ) flag++; if ( ver == '12.2(46)EX' ) flag++; if ( ver == '12.2(52)EX' ) flag++; if ( ver == '12.2(52)EX1' ) flag++; if ( ver == '12.2(53)EX' ) flag++; if ( ver == '12.2(55)EX' ) flag++; if ( ver == '12.2(55)EX1' ) flag++; if ( ver == '12.2(55)EX2' ) flag++; if ( ver == '12.2(55)EX3' ) flag++; if ( ver == '12.2(58)EX' ) flag++; if ( ver == '12.2(37)EY' ) flag++; if ( ver == '12.2(44)EY' ) flag++; if ( ver == '12.2(46)EY' ) flag++; if ( ver == '12.2(53)EY' ) flag++; if ( ver == '12.2(55)EY' ) flag++; if ( ver == '12.2(58)EY' ) flag++; if ( ver == '12.2(58)EY1' ) flag++; if ( ver == '12.2(58)EY2' ) flag++; if ( ver == '12.2(53)EZ' ) flag++; if ( ver == '12.2(55)EZ' ) flag++; if ( ver == '12.2(58)EZ' ) flag++; if ( ver == '12.2(60)EZ' ) flag++; if ( ver == '12.2(60)EZ1' ) flag++; if ( ver == '12.2(60)EZ2' ) flag++; if ( ver == '12.2(60)EZ3' ) flag++; if ( ver == '12.2(60)EZ4' ) flag++; if ( ver == '12.2(60)EZ5' ) flag++; if ( ver == '12.2(60)EZ6' ) flag++; if ( ver == '12.2(60)EZ7' ) flag++; if ( ver == '12.2(60)EZ8' ) flag++; if ( ver == '12.2(25)FZ' ) flag++; if ( ver == '12.2(35)SE' ) flag++; if ( ver == '12.2(35)SE1' ) flag++; if ( ver == '12.2(35)SE2' ) flag++; if ( ver == '12.2(35)SE3' ) flag++; if ( ver == '12.2(35)SE4' ) flag++; if ( ver == '12.2(35)SE5' ) flag++; if ( ver == '12.2(37)SE' ) flag++; if ( ver == '12.2(37)SE1' ) flag++; if ( ver == '12.2(40)SE' ) flag++; if ( ver == '12.2(40)SE1' ) flag++; if ( ver == '12.2(40)SE2' ) flag++; if ( ver == '12.2(44)SE' ) flag++; if ( ver == '12.2(44)SE1' ) flag++; if ( ver == '12.2(44)SE2' ) flag++; if ( ver == '12.2(44)SE3' ) flag++; if ( ver == '12.2(44)SE4' ) flag++; if ( ver == '12.2(44)SE5' ) flag++; if ( ver == '12.2(44)SE6' ) flag++; if ( ver == '12.2(46)SE' ) flag++; if ( ver == '12.2(46)SE1' ) flag++; if ( ver == '12.2(46)SE2' ) flag++; if ( ver == '12.2(50)SE' ) flag++; if ( ver == '12.2(50)SE1' ) flag++; if ( ver == '12.2(50)SE2' ) flag++; if ( ver == '12.2(50)SE3' ) flag++; if ( ver == '12.2(50)SE4' ) flag++; if ( ver == '12.2(50)SE5' ) flag++; if ( ver == '12.2(52)SE' ) flag++; if ( ver == '12.2(52)SE1' ) flag++; if ( ver == '12.2(53)SE' ) flag++; if ( ver == '12.2(53)SE1' ) flag++; if ( ver == '12.2(53)SE2' ) flag++; if ( ver == '12.2(54)SE' ) flag++; if ( ver == '12.2(55)SE' ) flag++; if ( ver == '12.2(55)SE1' ) flag++; if ( ver == '12.2(55)SE10' ) flag++; if ( ver == '12.2(55)SE2' ) flag++; if ( ver == '12.2(55)SE3' ) flag++; if ( ver == '12.2(55)SE4' ) flag++; if ( ver == '12.2(55)SE5' ) flag++; if ( ver == '12.2(55)SE6' ) flag++; if ( ver == '12.2(55)SE7' ) flag++; if ( ver == '12.2(55)SE8' ) flag++; if ( ver == '12.2(55)SE9' ) flag++; if ( ver == '12.2(58)SE' ) flag++; if ( ver == '12.2(58)SE1' ) flag++; if ( ver == '12.2(58)SE2' ) flag++; if ( ver == '12.2(25)SED' ) flag++; if ( ver == '12.2(25)SED1' ) flag++; if ( ver == '12.2(25)SEE' ) flag++; if ( ver == '12.2(25)SEE1' ) flag++; if ( ver == '12.2(25)SEE2' ) flag++; if ( ver == '12.2(25)SEE3' ) flag++; if ( ver == '12.2(25)SEE4' ) flag++; if ( ver == '12.2(25)SEF1' ) flag++; if ( ver == '12.2(25)SEF2' ) flag++; if ( ver == '12.2(25)SEF3' ) flag++; if ( ver == '12.2(25)SEG' ) flag++; if ( ver == '12.2(25)SEG1' ) flag++; if ( ver == '12.2(25)SEG2' ) flag++; if ( ver == '12.2(25)SEG3' ) flag++; if ( ver == '12.2(25)SEG4' ) flag++; if ( ver == '12.2(25)SEG5' ) flag++; if ( ver == '12.2(25)SEG6' ) flag++; if ( ver == '15.0(2)EB' ) flag++; if ( ver == '15.0(2)EC' ) flag++; if ( ver == '15.0(2)ED' ) flag++; if ( ver == '15.0(2)ED1' ) flag++; if ( ver == '15.0(2)EH' ) flag++; if ( ver == '15.0(2)EJ' ) flag++; if ( ver == '15.0(2)EJ1' ) flag++; if ( ver == '15.0(2)EK' ) flag++; if ( ver == '15.0(2)EK1' ) flag++; if ( ver == '15.0(1)EX' ) flag++; if ( ver == '15.0(2)EX' ) flag++; if ( ver == '15.0(2)EX1' ) flag++; if ( ver == '15.0(2)EX2' ) flag++; if ( ver == '15.0(2)EX3' ) flag++; if ( ver == '15.0(2)EX4' ) flag++; if ( ver == '15.0(2)EX5' ) flag++; if ( ver == '15.0(2)EX8' ) flag++; if ( ver == '15.0(2a)EX5' ) flag++; if ( ver == '15.0(1)EY' ) flag++; if ( ver == '15.0(1)EY1' ) flag++; if ( ver == '15.0(1)EY2' ) flag++; if ( ver == '15.0(2)EY' ) flag++; if ( ver == '15.0(2)EY1' ) flag++; if ( ver == '15.0(2)EY2' ) flag++; if ( ver == '15.0(2)EY3' ) flag++; if ( ver == '15.0(2)EZ' ) flag++; if ( ver == '15.0(1)SE' ) flag++; if ( ver == '15.0(1)SE1' ) flag++; if ( ver == '15.0(1)SE2' ) flag++; if ( ver == '15.0(1)SE3' ) flag++; if ( ver == '15.0(2)SE' ) flag++; if ( ver == '15.0(2)SE1' ) flag++; if ( ver == '15.0(2)SE2' ) flag++; if ( ver == '15.0(2)SE3' ) flag++; if ( ver == '15.0(2)SE4' ) flag++; if ( ver == '15.0(2)SE5' ) flag++; if ( ver == '15.0(2)SE6' ) flag++; if ( ver == '15.0(2)SE7' ) flag++; if ( ver == '15.2(1)E' ) flag++; if ( ver == '15.2(1)E1' ) flag++; if ( ver == '15.2(1)E2' ) flag++; if ( ver == '15.2(1)E3' ) flag++; if ( ver == '15.2(2)E' ) flag++; if ( ver == '15.2(2)E1' ) flag++; if ( ver == '15.2(2)E2' ) flag++; if ( ver == '15.2(2)E3' ) flag++; if ( ver == '15.2(2a)E1' ) flag++; if ( ver == '15.2(2a)E2' ) flag++; if ( ver == '15.2(3)E' ) flag++; if ( ver == '15.2(3)E1' ) flag++; if ( ver == '15.2(3)E2' ) flag++; if ( ver == '15.2(3a)E' ) flag++; if ( ver == '15.2(3m)E2' ) flag++; if ( ver == '15.2(3m)E3' ) flag++; if ( ver == '15.2(2)EB' ) flag++; if ( ver == '15.2(2)EB1' ) flag++; if ( ver == '15.2(1)EY' ) flag++; if ( ver == '15.2(2)EA1' ) flag++; if ( ver == '15.2(2)EA2' ) flag++; if ( ver == '15.2(3)EA' ) flag++; # Check for Smart Install client feature if (flag && get_kb_item("Host/local_checks_enabled")) { flag = 0; buf = cisco_command_kb_item("Host/Cisco/Config/show_vstack_config", "show vstack config"); if (check_cisco_result(buf)) { if ( (preg(multiline:TRUE, pattern:"Role:\s*[Cc]lient", string:buf)) && (!preg(multiline:TRUE, pattern:"Role:\s*[Cc]lient\s+\(SmartInstall disabled\)", string:buf)) ) { flag = 1; } } else if (cisco_needs_enable(buf)) { flag = 1; override = 1; } } if (flag) { if (report_verbosity > 0) { report = '\n Cisco bug ID : CSCuv45410' + '\n Installed release : ' + ver + '\n'; security_hole(port:0, extra:report + cisco_caveat(override)); exit(0); } else security_hole(port:0, extra:cisco_caveat(override)); } else audit(AUDIT_HOST_NOT, "affected");