Executive Summary

Summary
Title Cisco Wireless LAN Controller Simple Network Management Protocol Memory Leak Denial of Service Vulnerability
Informations
Name cisco-sa-20171101-wlc1 First vendor Publication 2017-11-01
Vendor Cisco Last vendor Modification 2017-11-01
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:A/AC:M/Au:S/C:N/I:N/A:C)
Cvss Base Score 5.2 Attack Range Adjacent network
Cvss Impact Score 6.9 Attack Complexity Medium
Cvss Expoit Score 4.4 Authentication Requires single instance
Calculate full CVSS 2.0 Vectors scores

Detail

A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco Wireless LAN Controllers could allow an authenticated, remote attacker to cause an affected device to restart, resulting in a denial of service (DoS) condition.

The vulnerability is due to a memory leak that occurs on an affected device after the device fails to deallocate a buffer that is used when certain MIBs are polled. An attacker who knows the SNMP Version 2 SNMP Read string or has valid SNMP Version 3 credentials for an affected device could repeatedly poll the affected MIB object IDs (OIDs) and consume available memory on the device. When memory is sufficiently depleted on the device, the device will restart, resulting in a DoS condition.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is available at the following link: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171101-wlc1 ["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171101-wlc1"]

BEGIN PGP SIGNATURE

iQKBBAEBAgBrBQJZ+fHgZBxDaXNjbyBTeXN0ZW1zIFByb2R1Y3QgU2VjdXJpdHkg SW5jaWRlbnQgUmVzcG9uc2UgVGVhbSAoQ2lzY28gUFNJUlQga2V5IDIwMTYtMjAx NykgPHBzaXJ0QGNpc2NvLmNvbT4ACgkQrz2APcQAkHmHng//SAZJp8OYZLywITU0 +pDgKpqLC93001+MrblT8/g0naWzF+W+M5kaDJ9zDRDTnYezKWNIyNQqrIgQ099d 7CZyzH8oDVf14qQUTubSXr8Ms7BCTJvqcYf1Ml7rERcd0fiwAj11789BHRtMMFVr QG9InX255PjyHZMDl6fyPtoBfbSXuaDy6yfV1k0zx0suSGDjo6ive4Pflpk/Hy58 mqJMH9DhXyiEG1ipiqMGB/GbtfW0/A7lI6hydUR9ks4J4oqvrszVB+tBUsaqeiZn os5yFWmy7YxqCqNDdzBXA+Gz83FEDPi56+REzYEsrYMTjJfAAhV+4v51EzcpBgnc hV3e1yzcxZ+uhpoFZDaAPUvCEIsk2qLDeqzZwol6GgXEwCwagMvmrjNSm/RJT8qv 1dRC/lRZAALtRipCtC6ufabBZbgXbzYFTLs1QjJSp7pbxFW+8S4q6Cr7KuWEDO36 5eubeB5taXSI8LJieXGUhYGRBMFxvlBwcOUEL6UwCMi8MCn8shD9LYPX9smsfXLw nnEv8stzKD+C9yKHBOnD7gvoV2VOEHZjEhmH5Yp/Gae5ruI2YoyQuSXq3e3BTBvW k77W5CS+en/NnlRT9tM4EYlOBYEPf/zuNusnof2B17d4hjjkE/aPzdkebVFFKeTA yXgIRWFUg/bgIBQtLzL2aMBjnA4= =GTn4 END PGP SIGNATURE

_______________________________________________ cust-security-announce mailing list cust-security-announce@cisco.com To unsubscribe, send the command "unsubscribe" in the subject of your message to cust-security-announce-leave@cisco.com

Original Source

Url : http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco (...)

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-772 Missing Release of Resource after Effective Lifetime

CPE : Common Platform Enumeration

TypeDescriptionCount
Os 1

Snort® IPS/IDS

Date Description
2017-11-02 Cisco Wireless LAN Controller cldcClientTable OID memory leak attempt
RuleID : 44727 - Revision : 1 - Type : PROTOCOL-SNMP
2017-11-02 Cisco Wireless LAN Controller cldcClientStatisticTable OID memory leak attempt
RuleID : 44726 - Revision : 1 - Type : PROTOCOL-SNMP
2017-11-02 Cisco Wireless LAN Controller clExtApDot11IfTable OID memory leak attempt
RuleID : 44725 - Revision : 2 - Type : PROTOCOL-SNMP

Nessus® Vulnerability Scanner

Date Description
2017-11-08 Name : The remote device is missing a vendor-supplied security patch.
File : cisco-sa-20171101-wireless_lan_controller_wlc1_wlc2_wcl4.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
2
3
Date Informations
2017-11-21 21:24:38
  • Multiple Updates
2017-11-09 13:25:12
  • Multiple Updates
2017-11-02 21:25:40
  • Multiple Updates
2017-11-01 21:22:49
  • First insertion