Vulnerabilities > CVE-2018-0165 - Missing Release of Resource after Effective Lifetime vulnerability in Cisco IOS XE 15.2(3)E/Denali16.3.3

047910
CVSS 6.1 - MEDIUM
Attack vector
ADJACENT_NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
COMPLETE
low complexity
cisco
CWE-772
nessus
NVD
Published: 2018-03-28
Updated: 2019-10-09

Summary

A vulnerability in the Internet Group Management Protocol (IGMP) packet-processing functionality of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to exhaust buffers on an affected device, resulting in a denial of service (DoS) condition, aka a Memory Leak. The vulnerability is due to the affected software insufficiently processing IGMP Membership Query packets that are sent to an affected device. An attacker could exploit this vulnerability by sending a large number of IGMP Membership Query packets, which contain certain values, to an affected device. A successful exploit could allow the attacker to exhaust buffers on the affected device, resulting in a DoS condition that requires the device to be reloaded manually. This vulnerability affects: Cisco Catalyst 4500 Switches with Supervisor Engine 8-E, if they are running Cisco IOS XE Software Release 3.x.x.E and IP multicast routing is configured; Cisco devices that are running Cisco IOS XE Software Release 16.x, if IP multicast routing is configured. Cisco Bug IDs: CSCuw09295, CSCve94496.

Vulnerable Configurations

Part Description Count
OS
Cisco
2
Hardware
Cisco
46

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • HTTP DoS
    An attacker performs flooding at the HTTP level to bring down only a particular web application rather than anything listening on a TCP/IP connection. This denial of service attack requires substantially fewer packets to be sent which makes DoS harder to detect. This is an equivalent of SYN flood in HTTP. The idea is to keep the HTTP session alive indefinitely and then repeat that hundreds of times. This attack targets resource depletion weaknesses in web server software. The web server will wait to attacker's responses on the initiated HTTP sessions while the connection threads are being exhausted.

Nessus

NASL familyCISCO
NASL idCISCO-SA-20180328-IGMP.NASL
descriptionAccording to its self-reported version, Cisco IOS XE Software is affected by a denial of service (DoS) vulnerability in the Internet Group Management Protocol (IGMP) packet-processing functionality. An unauthenticated, adjacent attacker can exploit this, by sending a large number of IGMP Membership Query packets containing certain values, to exhaust buffers on an affected device and cause it to stop responding. Please see the included Cisco BIDs and Cisco Security Advisory for more information. Note that Nessus has not tested for this issue but has instead relied only on the application
last seen2020-04-30
modified2019-11-29
plugin id131399
published2019-11-29
reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
sourcehttps://www.tenable.com/plugins/nessus/131399
titleCisco IOS XE Software Internet Group Management Protocol Memory Leak (cisco-sa-20180328-igmp)
code
#TRUSTED 25090fec40e5dd32024663880c56ff3d94583dbf2c1f128e272b91f8f8f53f4f98c638f63b7cc1654c25b600aeeb630b27c2862f5976f90e919305f513667d7041760007de0bcbeefe35a2e2773eaefa43b2a85b8a72e306056026e66ca0f1278286dca34af3cb5bcc6bb5832abc160e70b6a755d116d0ed05af8fb407806586ff5eb7accaacc22b112fa157e08a853ffe052f0c8a6239b134bd60a1ca472ef98a54523de7699e75df9e17ff314c5bb68153c02d3b36c0c3fdba0e6785cceb00bcc29ca85797899f6f19b057fdf92b4bce3579622fad2e1db6d0a2789b54297b8ec1fe3a69fb682c72e1b84c38b4ee469e2cadd271cb839dec0f79dad9738e9ebd74591ffcd5606e578e73e37ecc539ed7adc7e5b7841fff558e2f8d4847ff6b6e5b8910ea9042d2a59e13a476c998a55fc4360be0e74229cca34b3bc86c4c93c77fd500c69afa07e8a72dd4c25f0c0717871a53d950ebaeb045e71f95b0ce3fe5162642a4d4387b67647bdfd39d902e8a21f385676e21f0b163e7eec5229c7b73042e8c49e1e66f4a252712354e826278c711a8d435184f5fbd25f16ef7d6cb1369681e45f1cbf71e786cfc66e470ee210b1b67179dc091f47b3b17e86cc4ce015f4ebbb2482f2ed1b39bab5f252937edb30fc48830a9cddf0b3c421828a0b72a67ef321ef01f631cc16fda1dd850ea3d3c4f2ce45d434d004679f67f12872e
#
# (C) Tenable Network Security, Inc.
#

include('compat.inc');

if (description)
{
  script_id(131399);
  script_version("1.6");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/04/29");

  script_cve_id("CVE-2018-0165");
  script_bugtraq_id(103568);
  script_xref(name:"CISCO-BUG-ID", value:"CSCuw09295");
  script_xref(name:"CISCO-BUG-ID", value:"CSCve94496");
  script_xref(name:"CISCO-SA", value:"cisco-sa-20180328-igmp");

  script_name(english:"Cisco IOS XE Software Internet Group Management Protocol Memory Leak (cisco-sa-20180328-igmp)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco IOS XE Software is affected by a denial of service (DoS) vulnerability in
the Internet Group Management Protocol (IGMP) packet-processing functionality. An unauthenticated, adjacent attacker can
exploit this, by sending a large number of IGMP Membership Query packets containing certain values, to exhaust buffers
on an affected device and cause it to stop responding.

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-igmp
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?be52db3c");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuw09295");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCve94496");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID(s) CSCuw09295 and CSCve94496.");
  script_set_cvss_base_vector("CVSS2#AV:A/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-0165");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/03/28");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/03/28");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/11/29");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ios_xe");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ios_xe_version.nasl");
  script_require_keys("Host/Cisco/IOS-XE/Version");

  exit(0);
}

include('cisco_workarounds.inc');
include('ccf.inc');
include('lists.inc');

product_info = cisco::get_product_info(name:'Cisco IOS XE Software');

# Only Cisco Catalyst 4500 Switches with Supervisor Engine 8-E are vulnerable with version 3.x.x.E
version_list_4500 = make_list(
  '3.7.0E',
  '3.7.1E',
  '3.7.2E',
  '3.7.3E',
  '3.7.4E',
  '3.7.5E'
);

version_list_all = make_list(
  '16.2.1',
  '16.2.2',
  '3.8.0E',
  '16.3.1',
  '16.3.2',
  '16.3.3',
  '16.3.1a',
  '16.4.1',
  '16.4.2',
  '3.18.3bSP'
);

model = product_info['model'];
show_ver = get_kb_item_or_exit("Host/Cisco/show_ver");
device_model = get_kb_item_or_exit("Host/Cisco/device_model");

if (model =~ "45[0-9]{2}E" && device_model =~ "cat" && "WS-X45-SUP8-E" >< show_ver)
{
  cbi = 'CSCuw09295';
  version_list = collib::union(version_list_4500, version_list_all);
}
else
{
  cbi = 'CSCve94496';
  version_list = version_list_all;
}

workarounds = make_list(CISCO_WORKAROUNDS['ip_multicast_routing']);
workaround_params = make_list();

reporting = make_array(
  'port'     , 0,
  'severity' , SECURITY_WARNING,
  'version'  , product_info['version'],
  'bug_id'   , cbi,
  'cmds'     , make_list('show running-config')
);

cisco::check_and_report(
  product_info:product_info,
  workarounds:workarounds,
  workaround_params:workaround_params,
  reporting:reporting,
  vuln_versions:version_list
);

References