Vulnerabilities > CVE-2018-0172 - Out-of-bounds Write vulnerability in Cisco IOS and IOS XE

047910
CVSS 8.6 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
HIGH
network
low complexity
cisco
CWE-787
nessus
NVD
Published: 2018-03-28
Updated: 2024-11-21

Summary

A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability exists because the affected software performs incomplete input validation of option 82 information that it receives in DHCP Version 4 (DHCPv4) packets from DHCP relay agents. An attacker could exploit this vulnerability by sending a crafted DHCPv4 packet to an affected device. A successful exploit could allow the attacker to cause a heap overflow condition on the affected device, which will cause the device to reload and result in a DoS condition. Cisco Bug IDs: CSCvg62730.

Vulnerable Configurations

Part Description Count
OS
Cisco
2
Hardware
Rockwellautomation
6

Common Weakness Enumeration (CWE)

Nessus

  • NASL familyCISCO
    NASL idCISCO-SA-20180328-DHCPR3-IOS.NASL
    descriptionAccording to its self-reported version, the Cisco IOS software running on the remote device is affected by multiple denial of service vulnerabilities in the DHCP client implementation when parsing DHCP packets. An unauthenticated, remote attacker can exploit these issues, via specially crafted DHCP packets, to cause the device to reload.
    last seen2020-06-01
    modified2020-06-02
    plugin id109087
    published2018-04-17
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/109087
    titleCisco IOS DHCP Multiple Vulnerabilities
    code
    #TRUSTED 9457f47c7af343426ebe3c1875e533eed5aa04f9d7f25dd6d5cebf9443037a740bc49a437d09fbcadcd13ca2b7f4863bd47de4c07c3a68d61d2e8fc9906eb5a5df0c44f2cea0a5a7cee2d71924adab05e2d5ec2b632cf3a3d6437629dd578d61f1c53a723f3e329fde46031bde5e9f5bf92feed7260c53d5f44f47d84d64e97edc98f369ae533e81b165c08e36914c35b0263d4c1f5bcc9f9abb5ee43d28861798a9560a3e6c5accea34351a01038e3a12a800bea31d90002ad8c4f6d5735555caca49f0b6a7009c0f0648a4995e007a471f27232fd65d8935ac298443d261a930abd445ff90b38549b94e3a24dcb94fdedf72f85855ed04720c4fef8787fc2352e98e3dfab4cbf291838c8388bf916bfa3861b335c2fb0310b18c636caed86be971b0f687a7302175df21e063bea392e476d9b913adad092267321114cc7c9deccab80f1b9ac46accc8333d8c91cec50eb37e5ae5197baf48a8f3bbf04f2e354b3a469d1c8c6f2fa95a7ff3adefa89667b3165385d765a47842ec0060b1d55c553ef0cb971028e4b15db12300e662680e4028c8fb76d4b01fc5fefdeb3d3de58b182ca0ab94af48c92d075d213b46d264a4f2c1546c24cf63501bccd0f6fa4af187be2a50a244c17c746fd3115c93c8946c23d18b8a5534edad4c48b5028fd1916c91febef6c6a485fa3ef1a039d469ada2bf1556e6b8d7db3570be9c6d153b
#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(109087);
  script_version("1.6");
  script_cvs_date("Date: 2019/11/08");

  script_cve_id("CVE-2018-0172", "CVE-2018-0173", "CVE-2018-0174");
  script_bugtraq_id(103545, 103552, 103554);
  script_xref(name:"TRA", value:"TRA-2018-06");
  script_xref(name:"CISCO-BUG-ID", value:"CSCvg62730");
  script_xref(name:"CISCO-BUG-ID", value:"CSCvg62754");
  script_xref(name:"CISCO-BUG-ID", value:"CSCuh91645");
  script_xref(name:"CISCO-SA", value:"cisco-sa-20180328-dhcpr1");
  script_xref(name:"CISCO-SA", value:"cisco-sa-20180328-dhcpr2");
  script_xref(name:"CISCO-SA", value:"cisco-sa-20180328-dhcpr3");

  script_name(english:"Cisco IOS DHCP Multiple Vulnerabilities");
  script_summary(english:"Checks the IOS version.");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, the Cisco IOS software running
on the remote device is affected by multiple denial of service
vulnerabilities in the DHCP client implementation when parsing DHCP
packets. An unauthenticated, remote attacker can exploit these issues,
via specially crafted DHCP packets, to cause the device to reload.");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-dhcpr1
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?bfe8b7e0");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-dhcpr2
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2af6e16d");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-dhcpr3
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?570bb167");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvg62730");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvg62754");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuh91645");
  script_set_attribute(attribute:"see_also", value:"https://www.tenable.com/security/research/tra-2018-06");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID
CSCvg62730, CSCvg62754, and CSCuh91645.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/03/28");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/03/28");
  script_set_attribute(attribute:"plugin_publication_date", value:"2018/04/17");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ios");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ios_version.nasl");
  script_require_keys("Host/Cisco/IOS/Version");

  exit(0);
}

include("audit.inc");
include("cisco_func.inc");
include("cisco_kb_cmd_func.inc");

flag = 0;
override = 0;

ver = get_kb_item_or_exit("Host/Cisco/IOS/Version");

# Check for vuln versions
if (
  ver == '12.2(53)SE1' ||
  ver == '12.2(55)SE' ||
  ver == '12.2(46)SE' ||
  ver == '12.2(46)SE2' ||
  ver == '12.2(50)SE2' ||
  ver == '12.2(50)SE1' ||
  ver == '12.2(44)SE2' ||
  ver == '12.2(50)SE5' ||
  ver == '12.2(44)SE1' ||
  ver == '12.2(53)SE' ||
  ver == '12.2(44)SE4' ||
  ver == '12.2(55)SE3' ||
  ver == '12.2(55)SE2' ||
  ver == '12.2(44)SE' ||
  ver == '12.2(52)SE' ||
  ver == '12.2(58)SE' ||
  ver == '12.2(50)SE3' ||
  ver == '12.2(55)SE1' ||
  ver == '12.2(44)SE6' ||
  ver == '12.2(44)SE3' ||
ver == '12.2(53)SE2' ||
ver == '12.2(52)SE1' ||
ver == '12.2(46)SE1' ||
ver == '12.2(54)SE' ||
ver == '12.2(44)SE5' ||
ver == '12.2(50)SE4' ||
ver == '12.2(50)SE' ||
ver == '12.2(58)SE1' ||
ver == '12.2(55)SE4' ||
ver == '12.2(58)SE2' ||
ver == '12.2(55)SE5' ||
ver == '12.2(55)SE6' ||
ver == '12.2(55)SE7' ||
ver == '12.2(55)SE8' ||
ver == '12.2(55)SE9' ||
ver == '12.2(55)SE10' ||
ver == '12.2(55)SE11' ||
ver == '12.2(55)SE12' ||
ver == '12.2(55)SE13' ||
ver == '12.2(44)EX' ||
ver == '12.2(53)EX' ||
ver == '12.2(52)EX' ||
ver == '12.2(44)EX1' ||
ver == '12.2(55)EX' ||
ver == '12.2(46)EX' ||
ver == '12.2(52)EX1' ||
ver == '12.2(55)EX1' ||
ver == '12.2(55)EX2' ||
ver == '12.2(55)EX3' ||
ver == '12.2(58)EX' ||
ver == '12.2(46)EY' ||
ver == '12.2(55)EY' ||
ver == '12.2(52)EY1' ||
ver == '12.2(44)EY' ||
ver == '12.2(52)EY' ||
ver == '12.2(53)EY' ||
ver == '12.2(52)EY2' ||
ver == '12.2(52)EY1b' ||
ver == '12.2(52)EY1c' ||
ver == '12.2(58)EY' ||
ver == '12.2(52)EY3' ||
ver == '12.2(52)EY2a' ||
ver == '12.2(58)EY1' ||
ver == '12.2(52)EY4' ||
ver == '12.2(52)EY3a' ||
ver == '12.2(58)EY2' ||
ver == '12.2(58)EZ' ||
ver == '12.2(53)EZ' ||
ver == '12.2(55)EZ' ||
ver == '12.2(60)EZ' ||
ver == '12.2(60)EZ1' ||
ver == '12.2(60)EZ2' ||
ver == '12.2(60)EZ3' ||
ver == '12.2(60)EZ4' ||
ver == '12.2(60)EZ5' ||
ver == '12.2(60)EZ6' ||
ver == '12.2(60)EZ7' ||
ver == '12.2(60)EZ8' ||
ver == '12.2(60)EZ9' ||
ver == '12.2(60)EZ10' ||
ver == '12.2(60)EZ11' ||
ver == '12.2(60)EZ12' ||
ver == '12.2(50)SG3' ||
ver == '12.2(50)SG6' ||
ver == '12.2(53)SG1' ||
ver == '12.2(46)SG' ||
ver == '12.2(53)SG2' ||
ver == '12.2(50)SG5' ||
ver == '12.2(53)SG3' ||
ver == '12.2(50)SG8' ||
ver == '12.2(50)SG2' ||
ver == '12.2(54)SG1' ||
ver == '12.2(50)SG1' ||
ver == '12.2(52)SG' ||
ver == '12.2(54)SG' ||
ver == '12.2(50)SG' ||
ver == '12.2(50)SG7' ||
ver == '12.2(53)SG4' ||
ver == '12.2(50)SG4' ||
ver == '12.2(46)SG1' ||
ver == '12.2(53)SG5' ||
ver == '12.2(53)SG6' ||
ver == '12.2(53)SG7' ||
ver == '12.2(53)SG8' ||
ver == '12.2(53)SG9' ||
ver == '12.2(53)SG10' ||
ver == '12.2(53)SG11' ||
ver == '12.2(33)SRD7' ||
ver == '12.2(33)SRD6' ||
ver == '12.2(33)SRD2a' ||
ver == '12.2(33)SRD4' ||
ver == '12.2(33)SRD5' ||
ver == '12.2(33)SRD3' ||
ver == '12.2(33)SRD2' ||
ver == '12.2(33)SRD1' ||
ver == '12.2(33)SRD' ||
ver == '12.2(33)SRD8' ||
ver == '12.2(52)XO' ||
ver == '12.2(54)XO' ||
ver == '12.2(50)SQ2' ||
ver == '12.2(50)SQ1' ||
ver == '12.2(50)SQ' ||
ver == '12.2(50)SQ3' ||
ver == '12.2(50)SQ4' ||
ver == '12.2(50)SQ5' ||
ver == '12.2(50)SQ6' ||
ver == '12.2(50)SQ7' ||
ver == '12.2(33)SRE1' ||
ver == '12.2(33)SRE2' ||
ver == '12.2(33)SRE3' ||
ver == '12.2(33)SRE4' ||
ver == '12.2(33)SRE' ||
ver == '12.2(33)SRE0a' ||
ver == '12.2(33)SRE5' ||
ver == '12.2(33)SRE6' ||
ver == '12.2(33)SRE8' ||
ver == '12.2(33)SRE7' ||
ver == '12.2(33)SRE9' ||
ver == '12.2(33)SRE7a' ||
ver == '12.2(33)SRE10' ||
ver == '12.2(33)SRE11' ||
ver == '12.2(33)SRE9a' ||
ver == '12.2(33)SRE12' ||
ver == '12.2(33)SRE13' ||
ver == '12.2(33)SRE14' ||
ver == '12.2(33)SRE15' ||
ver == '12.2(33)SRE15a' ||
ver == '15.0(1)XO1' ||
ver == '15.0(1)XO' ||
ver == '15.0(2)XO' ||
ver == '15.0(1)S2' ||
ver == '15.0(1)S1' ||
ver == '15.0(1)S' ||
ver == '15.0(1)S3a' ||
ver == '15.0(1)S4' ||
ver == '15.0(1)S5' ||
ver == '15.0(1)S4a' ||
ver == '15.0(1)S6' ||
ver == '12.2(33)MRA' ||
ver == '12.2(33)MRB5' ||
ver == '12.2(33)MRB2' ||
ver == '12.2(33)MRB1' ||
ver == '12.2(33)MRB4' ||
ver == '12.2(33)MRB' ||
ver == '12.2(33)MRB3' ||
ver == '12.2(33)MRB6' ||
ver == '15.2(1)S' ||
ver == '15.2(2)S' ||
ver == '15.2(1)S1' ||
ver == '15.2(4)S' ||
ver == '15.2(1)S2' ||
ver == '15.2(2)S1' ||
ver == '15.2(2)S2' ||
ver == '15.2(2)S0a' ||
ver == '15.2(2)S0c' ||
ver == '15.2(4)S1' ||
ver == '15.2(4)S4' ||
ver == '15.2(4)S6' ||
ver == '15.2(4)S2' ||
ver == '15.2(4)S5' ||
ver == '15.2(4)S3' ||
ver == '15.2(4)S3a' ||
ver == '15.2(4)S4a' ||
ver == '15.2(4)S7' ||
ver == '15.0(1)EY' ||
ver == '15.0(1)EY1' ||
ver == '15.0(1)EY2' ||
ver == '15.0(2)EY' ||
ver == '15.0(2)EY1' ||
ver == '15.0(2)EY2' ||
ver == '15.0(2)EY3' ||
ver == '12.2(54)WO' ||
ver == '15.1(2)S' ||
ver == '15.1(1)S' ||
ver == '15.1(1)S1' ||
ver == '15.1(3)S' ||
ver == '15.1(1)S2' ||
ver == '15.1(2)S1' ||
ver == '15.1(2)S2' ||
ver == '15.1(3)S1' ||
ver == '15.1(3)S0a' ||
ver == '15.1(3)S2' ||
ver == '15.1(3)S4' ||
ver == '15.1(3)S3' ||
ver == '15.1(3)S5' ||
ver == '15.1(3)S6' ||
ver == '15.1(3)S5a' ||
ver == '15.0(1)SE' ||
ver == '15.0(2)SE' ||
ver == '15.0(1)SE1' ||
ver == '15.0(1)SE2' ||
ver == '15.0(1)SE3' ||
ver == '15.0(2)SE1' ||
ver == '15.0(2)SE2' ||
ver == '15.0(2)SE3' ||
ver == '15.0(2)SE4' ||
ver == '15.0(2)SE5' ||
ver == '15.0(2)SE6' ||
ver == '15.0(2)SE7' ||
ver == '15.0(2)SE8' ||
ver == '15.0(2)SE9' ||
ver == '15.0(2a)SE9' ||
ver == '15.0(2)SE10' ||
ver == '15.0(2)SE11' ||
ver == '15.0(2)SE10a' ||
ver == '15.0(2)SE12' ||
ver == '15.1(1)SG' ||
ver == '15.1(2)SG' ||
ver == '15.1(1)SG1' ||
ver == '15.1(1)SG2' ||
ver == '15.1(2)SG1' ||
ver == '15.1(2)SG2' ||
ver == '15.1(2)SG3' ||
ver == '15.1(2)SG4' ||
ver == '15.1(2)SG5' ||
ver == '15.1(2)SG6' ||
ver == '15.1(2)SG7' ||
ver == '15.1(2)SG8' ||
ver == '15.1(2)SG8a' ||
ver == '15.0(1)MR' ||
ver == '15.0(2)MR' ||
ver == '15.0(2)SG' ||
ver == '15.0(2)SG1' ||
ver == '15.0(2)SG2' ||
ver == '15.0(2)SG3' ||
ver == '15.0(2)SG4' ||
ver == '15.0(2)SG5' ||
ver == '15.0(2)SG6' ||
ver == '15.0(2)SG7' ||
ver == '15.0(2)SG8' ||
ver == '15.0(2)SG9' ||
ver == '15.0(2)SG10' ||
ver == '15.0(2)SG11' ||
ver == '15.1(1)MR' ||
ver == '15.1(1)MR1' ||
ver == '15.1(1)MR2' ||
ver == '15.1(1)MR3' ||
ver == '15.1(3)MR' ||
ver == '15.1(1)MR4' ||
ver == '15.0(1)EX' ||
ver == '15.0(2)EX' ||
ver == '15.0(2)EX1' ||
ver == '15.0(2)EX2' ||
ver == '15.0(2)EX3' ||
ver == '15.0(2)EX4' ||
ver == '15.0(2)EX5' ||
ver == '15.0(2)EX8' ||
ver == '15.0(2a)EX5' ||
ver == '15.0(2)EX10' ||
ver == '15.0(2)EX11' ||
ver == '15.0(2)EX13' ||
ver == '15.0(2)EX12' ||
ver == '15.1(2)EY' ||
ver == '15.1(2)EY1a' ||
ver == '15.1(2)EY2' ||
ver == '15.1(2)EY3' ||
ver == '15.1(2)EY2a' ||
ver == '15.1(2)EY4' ||
ver == '15.1(2)SNG' ||
ver == '15.3(1)S' ||
ver == '15.3(2)S' ||
ver == '15.3(3)S' ||
ver == '15.3(1)S2' ||
ver == '15.3(1)S1' ||
ver == '15.3(2)S2' ||
ver == '15.3(2)S1' ||
ver == '15.3(3)S1' ||
ver == '15.3(3)S2' ||
ver == '15.3(3)S3' ||
ver == '15.3(3)S6' ||
ver == '15.3(3)S4' ||
ver == '15.3(3)S1a' ||
ver == '15.3(3)S5' ||
ver == '15.3(3)S7' ||
ver == '15.3(3)S8' ||
ver == '15.3(3)S9' ||
ver == '15.3(3)S10' ||
ver == '15.3(3)S8a' ||
ver == '15.1(2)SNH' ||
ver == '15.1(2)SNI' ||
ver == '15.1(2)SNI1' ||
ver == '15.2(2)SNG' ||
ver == '15.0(2)EC' ||
ver == '15.0(2)EB' ||
ver == '15.2(1)E' ||
ver == '15.2(2)E' ||
ver == '15.2(1)E1' ||
ver == '15.2(3)E' ||
ver == '15.2(1)E2' ||
ver == '15.2(1)E3' ||
ver == '15.2(2)E1' ||
ver == '15.2(4)E' ||
ver == '15.2(3)E1' ||
ver == '15.2(2)E2' ||
ver == '15.2(2a)E1' ||
ver == '15.2(2)E3' ||
ver == '15.2(2a)E2' ||
ver == '15.2(3)E2' ||
ver == '15.2(3a)E' ||
ver == '15.2(3)E3' ||
ver == '15.2(3m)E2' ||
ver == '15.2(4)E1' ||
ver == '15.2(2)E4' ||
ver == '15.2(2)E5' ||
ver == '15.2(4)E2' ||
ver == '15.2(4m)E1' ||
ver == '15.2(3)E4' ||
ver == '15.2(5)E' ||
ver == '15.2(4)E3' ||
ver == '15.2(2)E6' ||
ver == '15.2(5a)E' ||
ver == '15.2(5)E1' ||
ver == '15.2(5b)E' ||
ver == '15.2(4m)E3' ||
ver == '15.2(3m)E8' ||
ver == '15.2(2)E5a' ||
ver == '15.2(5c)E' ||
ver == '15.2(3)E5' ||
ver == '15.2(2)E5b' ||
ver == '15.2(4n)E2' ||
ver == '15.2(4o)E2' ||
ver == '15.2(5a)E1' ||
ver == '15.2(4)E4' ||
ver == '15.2(2)E7' ||
ver == '15.2(5)E2' ||
ver == '15.2(4p)E1' ||
ver == '15.2(6)E' ||
ver == '15.2(5)E2b' ||
ver == '15.2(4)E5' ||
ver == '15.2(5)E2c' ||
ver == '15.2(2)E8' ||
ver == '15.2(4m)E2' ||
ver == '15.2(4o)E3' ||
ver == '15.2(4q)E1' ||
ver == '15.2(6)E0a' ||
ver == '15.2(6)E0b' ||
ver == '15.2(2)E7b' ||
ver == '15.2(4)E5a' ||
ver == '15.2(6)E0c' ||
ver == '15.2(2)E9' ||
ver == '15.1(3)MRA' ||
ver == '15.1(3)MRA1' ||
ver == '15.1(3)MRA2' ||
ver == '15.1(3)MRA3' ||
ver == '15.1(3)MRA4' ||
ver == '15.2(2)SNH1' ||
ver == '15.0(2)ED' ||
ver == '15.0(2)ED1' ||
ver == '15.4(1)S' ||
ver == '15.4(2)S' ||
ver == '15.4(3)S' ||
ver == '15.4(1)S1' ||
ver == '15.4(1)S2' ||
ver == '15.4(2)S1' ||
ver == '15.4(1)S3' ||
ver == '15.4(3)S1' ||
ver == '15.4(2)S2' ||
ver == '15.4(3)S2' ||
ver == '15.4(3)S3' ||
ver == '15.4(1)S4' ||
ver == '15.4(2)S3' ||
ver == '15.4(2)S4' ||
ver == '15.4(3)S4' ||
ver == '15.4(3)S5' ||
ver == '15.4(3)S6' ||
ver == '15.4(3)S7' ||
ver == '15.4(3)S6a' ||
ver == '15.4(3)S8' ||
ver == '15.2(2)SNI' ||
ver == '15.0(2)EZ' ||
ver == '15.2(1)EY' ||
ver == '15.0(2)EJ' ||
ver == '15.0(2)EJ1' ||
ver == '15.0(2)EH' ||
ver == '15.2(5)EX' ||
ver == '15.0(2)EK' ||
ver == '15.0(2)EK1' ||
ver == '15.5(1)S' ||
ver == '15.5(2)S' ||
ver == '15.5(1)S1' ||
ver == '15.5(3)S' ||
ver == '15.5(1)S2' ||
ver == '15.5(1)S3' ||
ver == '15.5(2)S1' ||
ver == '15.5(2)S2' ||
ver == '15.5(3)S1' ||
ver == '15.5(3)S1a' ||
ver == '15.5(2)S3' ||
ver == '15.5(3)S2' ||
ver == '15.5(3)S0a' ||
ver == '15.5(3)S3' ||
ver == '15.5(1)S4' ||
ver == '15.5(2)S4' ||
ver == '15.5(3)S4' ||
ver == '15.5(3)S5' ||
ver == '15.5(3)S6' ||
ver == '15.5(3)S6a' ||
ver == '15.5(3)S6b' ||
ver == '15.1(3)SVG' ||
ver == '15.2(2)EB' ||
ver == '15.2(2)EB1' ||
ver == '15.2(2)EB2' ||
ver == '15.5(3)SN' ||
ver == '15.0(2)SQD' ||
ver == '15.0(2)SQD1' ||
ver == '15.0(2)SQD2' ||
ver == '15.0(2)SQD3' ||
ver == '15.0(2)SQD4' ||
ver == '15.0(2)SQD5' ||
ver == '15.0(2)SQD6' ||
ver == '15.0(2)SQD7' ||
ver == '15.6(1)S' ||
ver == '15.6(2)S' ||
ver == '15.6(2)S1' ||
ver == '15.6(1)S1' ||
ver == '15.6(1)S2' ||
ver == '15.6(2)S0a' ||
ver == '15.6(2)S2' ||
ver == '15.6(1)S3' ||
ver == '15.6(2)S3' ||
ver == '15.6(1)S4' ||
ver == '15.6(2)S4' ||
ver == '15.6(2)SP' ||
ver == '15.6(2)SP1' ||
ver == '15.6(2)SP2' ||
ver == '15.6(2)SP3' ||
ver == '15.6(2)SP3b' ||
ver == '15.6(2)SN' ||
ver == '15.1(3)SVJ2' ||
ver == '15.2(4)EC1' ||
ver == '15.2(4)EC2'
) flag++;

cmds = make_list();
if (flag && get_kb_item("Host/local_checks_enabled"))
{
  flag = 0;
  buf = cisco_command_kb_item("Host/Cisco/Config/show running-config | include ip helper-address", "show running-config | include ip helper-address");
  if (check_cisco_result(buf))
  {
    if (preg(string:buf, pattern:"ip helper-address", multiline:TRUE))
    {
      cmds = make_list(cmds, "show running-config | include ip helper-address");
      buf2 =  cisco_command_kb_item("Host/Cisco/Config/show running-config | include ip dhcp relay information option", "show running-config | include ip dhcp relay information option");
      if (check_cisco_result(buf2))
      {
        if (preg(multiline:TRUE, pattern:"ip dhcp relay information option", string:buf2))
        {
          cmds = make_list(cmds,"show running-config | include ip dhcp relay information option");
          flag = 1;
        }
      }
    }
  }
  else if (cisco_needs_enable(buf))
    override = 1;

  if (!flag && !override) audit(AUDIT_OS_CONF_NOT_VULN, "Cisco IOS", ver);
}

if (flag || override)
{
  security_report_cisco(
    port     : 0,
    severity : SECURITY_HOLE,
    override : override,
    version  : ver,
    bug_id   : "CSCvg62730, CSCvg62754, CSCuh91645",
    cmds     : cmds
  );
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");
  • NASL familyCISCO
    NASL idCISCO-SA-20180328-DHCPR3-IOSXE.NASL
    descriptionAccording to its self-reported version, the Cisco IOS software running on the remote device is affected by multiple denial of service vulnerabilities in the DHCP client implementation when parsing DHCP packets. An unauthenticated, remote attacker can exploit these issues, via specially crafted DHCP packets, to cause the device to reload.
    last seen2020-06-01
    modified2020-06-02
    plugin id109088
    published2018-04-17
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/109088
    titleCisco IOS DHCP Multiple Vulnerabilities

References