6.1 - cisco-sa-20180926-cmp

A vulnerability in the implementation of the cluster feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to trigger a denial of service (DoS) condition on an affected device.

The vulnerability is due to improper input validation when handling Cluster Management Protocol (CMP) messages. An attacker could exploit this vulnerability by sending a malicious CMP message to an affected device. A successful exploit could allow the attacker to cause the switch to crash and reload or to hang, resulting in a DoS condition. If the switch hangs it will not reboot automatically, and it will need to be power cycled manually to recover.

Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability.

This advisory is available at the following link:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-cmp ["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-cmp"]

This advisory is part of the September 26, 2018, release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication, which includes 12 Cisco Security Advisories that describe 13 vulnerabilities. For a complete list of the advisories and links to them, see Cisco Event Response: September 2018 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication ["http://tools.cisco.com/security/center/viewErp.x?alertId=ERP-69981"].

BEGIN PGP SIGNATURE

iQJ5BAEBAgBjBQJbq67jXBxDaXNjbyBQcm9kdWN0IFNlY3VyaXR5IEluY2lkZW50 IFJlc3BvbnNlIFRlYW0gKENpc2NvIFBTSVJUIGtleSAyMDE4LTIwMTkpIDxwc2ly dEBjaXNjby5jb20+AAoJEJa12PPJBfcz8zMQAI09Se5r1EQmLWwWnm3EXfLDwILf YwnxnQMv4nM2h7dnEqD5U6Hs2/p4eCYXVEouCLJk0afzPAf6Z9hH1OjtFECpMr/t aloCZ0+MMIo3I/ZcC9MRwS4m2gsZReH2e0Bs+seWnxCnRRgLaznw5mj0yxAEmo4O LvRZQNFJx1Ku1PN2ZfBZOpv5p6XEIF2dCS1TtLCCZclzhbClP3tz9K/2gm6Ukx7b to1AC9CKdNxrT/mN4ON4QyTLNY12iPzb/LDwgtzXiqfgNREDD0CPQDZljHQ0GJ ++kTAuegMqCchwoY0p+Ebly7mGr84t5IZKvFi3UxwjEE/HEKxok3e7gjDwHDLw8fol Hkmqy630Mkdrc52qe9QRgODvoeXE3SXuF7LRVK6rCNUYa0FLhLFVIpR7CLnp4Tqc IK4qJy1dio8jzRDl+S/wnM3tU7MV3PnmGRtVH9LO7Q4EJsl29sG76FT8dKxcOScP ZFc7Wu5Pnu2lI97LujYvgYaRseRuO0qMkB5VsBEBBxdSuIWGPbnzk//vcOybpC6c UMHYan9DoANvYd6CLXUvVf8Dp25CIoPr3lST/W0dp761i/HtLyK+BiWeL6oFxgff kRODG/PLC6GkruMwLF/KkMn7ZMvRJBwOnjKTwbbQv0OFXEKoWYPt0nanNUETLvRF AuJNtzErkDZD69gP =ZSAn END PGP SIGNATURE

_______________________________________________ cust-security-announce mailing list cust-security-announce@cisco.com To unsubscribe, send the command "unsubscribe" in the subject of your message to cust-security-announce-leave@cisco.com