CVE-2018-0256: Input Validation
First published: Thu Apr 19 2018(Updated: )
A vulnerability in the peer-to-peer message processing functionality of Cisco Packet Data Network Gateway could allow an unauthenticated, remote attacker to cause the Session Manager (SESSMGR) process on an affected device to restart, resulting in a denial of service (DoS) condition. The vulnerability is due to incorrect validation of peer-to-peer packet headers. An attacker could exploit this vulnerability by sending a crafted peer-to-peer packet through an affected device. A successful exploit could allow the attacker to cause the SESSMGR process on the affected device to restart unexpectedly, which could briefly impact traffic while the SESSMGR process restarts and result in a DoS condition. Cisco Bug IDs: CSCvg88786.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco ASR 5000 Series Aggregation Services Routers | =20.3.0.66671 | |
| Cisco ASR 5000 Series Aggregation Services Routers | =p2p_2.16.879 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2018-0256?
CVE-2018-0256 has a severity rating that suggests it could allow denial of service conditions.
How do I fix CVE-2018-0256?
To fix CVE-2018-0256, update your Cisco ASR 5000 Series software to the latest version that addresses this vulnerability.
What is the impact of CVE-2018-0256?
The impact of CVE-2018-0256 is that it can cause the Session Manager process to restart, leading to service disruptions.
Who is affected by CVE-2018-0256?
CVE-2018-0256 affects devices running specific versions of Cisco ASR 5000 Series software, particularly versions 20.3.0.66671 and p2p_2.16.879.
Is authentication required to exploit CVE-2018-0256?
No, CVE-2018-0256 can be exploited by an unauthenticated remote attacker.
- agent/references
- agent/type
- agent/severity
- agent/weakness
- agent/author
- agent/first-publish-date
- agent/softwarecombine
- agent/event
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco asr 5000 series aggregation services routers
- version/cisco asr 5000 series aggregation services routers/20.3.0.66671
- version/cisco asr 5000 series aggregation services routers/p2p_2.16.879