CVE-2019-1741: Cisco IOS XE Software Encrypted Traffic Analytics Denial of Service Vulnerability
First published: Wed Mar 27 2019(Updated: )
A vulnerability in the Cisco Encrypted Traffic Analytics (ETA) feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to a logic error that exists when handling a malformed incoming packet, leading to access to an internal data structure after it has been freed. An attacker could exploit this vulnerability by sending crafted, malformed IP packets to an affected device. A successful exploit could allow the attacker to cause an affected device to reload, resulting in a DoS condition.
Credit: ykramarz@cisco.com ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco IOS XE Software | =3.2.0ja | |
| Cisco IOS XE Software | =16.6.1 | |
| Cisco IOS XE Software | =16.6.2 | |
| Cisco IOS XE Software | =16.6.3 | |
| Cisco IOS XE Software | =16.7.1 | |
| Cisco IOS XE Software | =16.7.1a | |
| Cisco IOS XE Software | =16.7.1b | |
| Cisco IOS XE Software | =16.8.1 | |
| Cisco IOS XE Software | =16.8.1a | |
| Cisco IOS XE Software | =16.8.1b | |
| Cisco IOS XE Software | =16.8.1c | |
| Cisco IOS XE Software | =16.8.1d | |
| Cisco IOS XE Software | =16.8.1e | |
| Cisco IOS XE Software | =16.8.1s |
Remedy
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190327-eta-dos
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2019-1741?
The severity of CVE-2019-1741 is considered high due to the potential for a denial of service condition.
How do I fix CVE-2019-1741?
To fix CVE-2019-1741, update Cisco IOS XE Software to the latest patched version provided by Cisco.
What versions of Cisco IOS XE are affected by CVE-2019-1741?
CVE-2019-1741 affects multiple versions, including 3.2.0ja and several 16.x versions up to 16.8.1s.
Can CVE-2019-1741 be exploited remotely?
Yes, CVE-2019-1741 can be exploited remotely by an unauthenticated attacker.
What impact does CVE-2019-1741 have on network devices?
CVE-2019-1741 can lead to a denial of service condition, disrupting normal operations of affected network devices.
- agent/references
- agent/type
- agent/weakness
- agent/title
- agent/remedy
- agent/severity
- agent/description
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/event
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/cisco
- canonical/cisco ios xe
- version/cisco ios xe/3.2.0ja
- version/cisco ios xe/16.6.1
- version/cisco ios xe/16.6.2
- version/cisco ios xe/16.6.3
- version/cisco ios xe/16.7.1
- version/cisco ios xe/16.7.1a
- version/cisco ios xe/16.7.1b
- version/cisco ios xe/16.8.1
- version/cisco ios xe/16.8.1a
- version/cisco ios xe/16.8.1b
- version/cisco ios xe/16.8.1c
- version/cisco ios xe/16.8.1d
- version/cisco ios xe/16.8.1e
- version/cisco ios xe/16.8.1s