Executive Summary
Summary | |
---|---|
Title | Cisco IOS XE Software Locator/ID Separation Protocol Authentication Bypass Vulnerability |
Informations | |||
---|---|---|---|
Name | cisco-sa-20170927-lisp | First vendor Publication | 2017-09-27 |
Vendor | Cisco | Last vendor Modification | 2017-09-27 |
Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
---|---|---|---|
Cvss Base Score | 7.5 | Attack Range | Network |
Cvss Impact Score | 6.4 | Attack Complexity | Low |
Cvss Expoit Score | 10 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
A vulnerability in the implementation of the Locator/ID Separation Protocol (LISP) in Cisco IOS XE Software could allow an unauthenticated, remote attacker using an x tunnel router to bypass authentication checks performed when registering an Endpoint Identifier (EID) to a Routing Locator (RLOC) in the map server/map resolver (MS/MR). The vulnerability is due to a logic error introduced via a code regression for the affected software. An attacker could exploit this vulnerability by sending specific valid map-registration requests, which will be accepted by the MS/MR even if the authentication keys do not match, to the affected software. A successful exploit could allow the attacker to inject invalid mappings of EIDs to RLOCs in the MS/MR of the affected software. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-lisp ["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-lisp"] This advisory is part of the September 27, 2017, release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication, which includes 12 Cisco Security Advisories that describe 13 vulnerabilities. For a complete list of the advisories and links to them, see Cisco Event Response: September 2017 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication ["https://tools.cisco.com/security/center/viewErp.x?alertId=ERP-63410"]. BEGIN PGP SIGNATURE iQKBBAEBAgBrBQJZy81/ZBxDaXNjbyBTeXN0ZW1zIFByb2R1Y3QgU2VjdXJpdHkg SW5jaWRlbnQgUmVzcG9uc2UgVGVhbSAoQ2lzY28gUFNJUlQga2V5IDIwMTYtMjAx NykgPHBzaXJ0QGNpc2NvLmNvbT4ACgkQrz2APcQAkHki7w//Y9htlcyaKuEy1jin p456PwWEi706Z8VdbUuPEIVy3k04CGGB/VZDg6JRwgjPodYysTWbH9Pbj7mCbJ7U vWjdvlm1thDk2FX40BRxUvlTkR5j6zM+0DvPMN9/NImJwe+d9lGgOkIZvhW3SGyr Ta/AMe25e9cS3cpeemR4F/JFw0eeiwlizJ7bDACegvOGWnJJnsGejekHhAl7o4ey QaIW86yjaAyx49VgX+EE6YrpufM1oyW1ZYYZCVA3oUDM3EHwdGKk3vE2QjT67uZQ F78BFr4uXX4TSyPs+wVuUa24TmPWyzXgl5eSA3d63/xtWBjtuOk8UDE9eCXo9udX D2qmf9SjgOZVqHa2k7K72z02udpffbRv+VC/V1ciTqep/c3L4v+6wpTUkdJXI7we E9D4tbNKhuvRU4f2RWIjZhMu+y9V6JSfAW9/AI8yL38vTmUCS82mZPYllOOOSDGH HkJvCBk7aElbHiU7t6wdhPNrnZ8D1BOvPCC40rLmfm35Y7CxHIv2zHRPtz8IfIID gRs23+CxPc0Yx1lNcWO/gHcXlwXJ5wDb01ZTjzLMrV4KNz7j3m7ixMRHKueBr+U8 p3mIYkG/rSXhoV0DWq33P3KuiPCI/YfbAfxdk1FwoYODSC+JJhBubBwF8roc8w8U YrWnEEA5933oUPsr92D6HlvE+u8= =TBum END PGP SIGNATURE _______________________________________________ cust-security-announce mailing list cust-security-announce@cisco.com To unsubscribe, send the command "unsubscribe" in the subject of your message to cust-security-announce-leave@cisco.com |
Original Source
Url : http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco (...) |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-287 | Improper Authentication |
CPE : Common Platform Enumeration
Type | Description | Count |
---|---|---|
Os | 3 |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2017-10-06 | Name : The remote device is missing a vendor-supplied security patch. File : cisco-sa-20170927-lisp-ios_xe.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2017-10-07 13:25:06 |
|
2017-10-07 00:24:30 |
|
2017-09-29 09:26:02 |
|
2017-09-27 21:23:05 |
|