Vulnerabilities > CVE-2018-0165 - Missing Release of Resource after Effective Lifetime vulnerability in Cisco IOS XE 15.2(3)E/Denali16.3.3

#TRUSTED 25090fec40e5dd32024663880c56ff3d94583dbf2c1f128e272b91f8f8f53f4f98c638f63b7cc1654c25b600aeeb630b27c2862f5976f90e919305f513667d7041760007de0bcbeefe35a2e2773eaefa43b2a85b8a72e306056026e66ca0f1278286dca34af3cb5bcc6bb5832abc160e70b6a755d116d0ed05af8fb407806586ff5eb7accaacc22b112fa157e08a853ffe052f0c8a6239b134bd60a1ca472ef98a54523de7699e75df9e17ff314c5bb68153c02d3b36c0c3fdba0e6785cceb00bcc29ca85797899f6f19b057fdf92b4bce3579622fad2e1db6d0a2789b54297b8ec1fe3a69fb682c72e1b84c38b4ee469e2cadd271cb839dec0f79dad9738e9ebd74591ffcd5606e578e73e37ecc539ed7adc7e5b7841fff558e2f8d4847ff6b6e5b8910ea9042d2a59e13a476c998a55fc4360be0e74229cca34b3bc86c4c93c77fd500c69afa07e8a72dd4c25f0c0717871a53d950ebaeb045e71f95b0ce3fe5162642a4d4387b67647bdfd39d902e8a21f385676e21f0b163e7eec5229c7b73042e8c49e1e66f4a252712354e826278c711a8d435184f5fbd25f16ef7d6cb1369681e45f1cbf71e786cfc66e470ee210b1b67179dc091f47b3b17e86cc4ce015f4ebbb2482f2ed1b39bab5f252937edb30fc48830a9cddf0b3c421828a0b72a67ef321ef01f631cc16fda1dd850ea3d3c4f2ce45d434d004679f67f12872e
#
# (C) Tenable Network Security, Inc.
#

include('compat.inc');

if (description)
{
  script_id(131399);
  script_version("1.6");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/04/29");

  script_cve_id("CVE-2018-0165");
  script_bugtraq_id(103568);
  script_xref(name:"CISCO-BUG-ID", value:"CSCuw09295");
  script_xref(name:"CISCO-BUG-ID", value:"CSCve94496");
  script_xref(name:"CISCO-SA", value:"cisco-sa-20180328-igmp");

  script_name(english:"Cisco IOS XE Software Internet Group Management Protocol Memory Leak (cisco-sa-20180328-igmp)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco IOS XE Software is affected by a denial of service (DoS) vulnerability in
the Internet Group Management Protocol (IGMP) packet-processing functionality. An unauthenticated, adjacent attacker can
exploit this, by sending a large number of IGMP Membership Query packets containing certain values, to exhaust buffers
on an affected device and cause it to stop responding.

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-igmp
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?be52db3c");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuw09295");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCve94496");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID(s) CSCuw09295 and CSCve94496.");
  script_set_cvss_base_vector("CVSS2#AV:A/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-0165");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/03/28");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/03/28");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/11/29");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ios_xe");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ios_xe_version.nasl");
  script_require_keys("Host/Cisco/IOS-XE/Version");

  exit(0);
}

include('cisco_workarounds.inc');
include('ccf.inc');
include('lists.inc');

product_info = cisco::get_product_info(name:'Cisco IOS XE Software');

# Only Cisco Catalyst 4500 Switches with Supervisor Engine 8-E are vulnerable with version 3.x.x.E
version_list_4500 = make_list(
  '3.7.0E',
  '3.7.1E',
  '3.7.2E',
  '3.7.3E',
  '3.7.4E',
  '3.7.5E'
);

version_list_all = make_list(
  '16.2.1',
  '16.2.2',
  '3.8.0E',
  '16.3.1',
  '16.3.2',
  '16.3.3',
  '16.3.1a',
  '16.4.1',
  '16.4.2',
  '3.18.3bSP'
);

model = product_info['model'];
show_ver = get_kb_item_or_exit("Host/Cisco/show_ver");
device_model = get_kb_item_or_exit("Host/Cisco/device_model");

if (model =~ "45[0-9]{2}E" && device_model =~ "cat" && "WS-X45-SUP8-E" >< show_ver)
{
  cbi = 'CSCuw09295';
  version_list = collib::union(version_list_4500, version_list_all);
}
else
{
  cbi = 'CSCve94496';
  version_list = version_list_all;
}

workarounds = make_list(CISCO_WORKAROUNDS['ip_multicast_routing']);
workaround_params = make_list();

reporting = make_array(
  'port'     , 0,
  'severity' , SECURITY_WARNING,
  'version'  , product_info['version'],
  'bug_id'   , cbi,
  'cmds'     , make_list('show running-config')
);

cisco::check_and_report(
  product_info:product_info,
  workarounds:workarounds,
  workaround_params:workaround_params,
  reporting:reporting,
  vuln_versions:version_list
);