CVSS2
Attack Vector
ADJACENT_NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:A/AC:L/Au:N/C:N/I:N/A:C
CVSS3
Attack Vector
ADJACENT
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
EPSS
Percentile
42.0%
According to its self-reported version, Cisco IOS XE Software is affected by a denial of service (DoS) vulnerability in the Internet Group Management Protocol (IGMP) packet-processing functionality. An unauthenticated, adjacent attacker can exploit this, by sending a large number of IGMP Membership Query packets containing certain values, to exhaust buffers on an affected device and cause it to stop responding.
Please see the included Cisco BIDs and Cisco Security Advisory for more information.
Note that Nessus has not tested for this issue but has instead relied only on the application’s self-reported version number.
#TRUSTED 62c2051a5312db1ba354a5e0c2b05a64b1669c343140d42129b7bdf248a3580ca4395193a5d4dadd5c6e8432d61a654b2369733647a261da888a3fb3375c0eff4efbe3ffed121febdfcd2b0ebe4d2ed4dd24b77ccc8419d7fe9bab874242f6ecceb0bfef379437eea663c1ecefd5ae21ac61d64d674d025853fe1360e4923a396ef2bbc38ff36139d682d477f1adff6957690e8db00799d0fbe01805f2f9b9d8d7a69ae3b5aa0eaa86810503510ddf2926f349a5953174d331b26a7d58cf6d7063df933fb50efca182641d5ba42ccbfd1c966da08d90c9089a00173b328ee8254c717a9c5a4368a53fbea0a5639780f31daff9b0702c04eda0064dc8b62a7f66daad0e09909ad0a5a4696469498bd740f138e168d39cef5d2e058e5b8feab513540cf828b4da95e532e242732f157242c4cbe3176c1326a0897ff48a1e4d47484a80ea35ae6cb9318270b9e78488998877716e98f01c2a17955f89fe7817d07d4699824882b612daf1e087e20b69b60978bdb62fbc56f3d6254a6d54e0e6a76351133d9cd29bfdf7e8de7765a292488f4fb4beadd976383a5d6a01f571f826d6ec499a26a12d5c13974c1a128abfd98e75ac45e4061b3fffa77c21bc012c396af87366a5d8de5048aa4d93d7449c5465bc856392b7f43c3b221b363d83a1c97f9ea2e4cbb4452623e87791937fe96643c808b1e9468eee60c98ae5f0de418751
#TRUST-RSA-SHA256 b2e9908f772342e0ad001c5fa5f7a88d6449dd09725da1f600b92ce2df957586e95f13d8ac02435a6266f793bb0e3b4cf8c2c57f1e94b473f2b2055e9976b60c0b19d75346dc6a0629e40e1a4bc13e35d703fe0870fb690a4990bfcc6bef6af493115dd8ec1c6f6a5d598c6896e347fda1107ea836504947c6582e01257b367c86fc4c498d927c4d6f2eaf9e46345fcbc09f84f658c17f497e2e43a5827761eedfab14c2bbac1f81b2508a397fbe327d209f3a9ddc1792e5401aed6374f301348c5a6b1234e2a7bca1e2cce03563002608e171900ecc2e4f32e46c05695d01e54d6992837907e2184ae2f743d3f2ec009dd4a0a0e9629b68d964f3344fd96579ef93b877291d7b3653459552f848a42af4f4c30cc7540f36d8ea09f4635f0f1353dfd3ebc8bbfef403eaaeb64116f6e59fae67004b0f7395abe6730b2a5408aa7223a816ff03ee1cf04a37c6d661eeb9a631a64a9a778f3298b6d6ff6b46d3bcd6a24fdb40020d0878bd4c7fcc1772f62aec679a9260bbf802e3e0b23a36bffd94dd5dd375976de9da2092edbbae574d90169a54c138b2cc02ae9387dd2ade143e0409849476f7b80b967da352b5815e5137b7f83b73e78c8ff060a842335cf31aa538a15f7f8733720d801fd8f39ed821b6eaeb8aed50b18115676da4ee8c03bede751c8b2c1b06d22d76fa17cfb8aa5d3b3e11f0dc4314bdaf24d9418769d5
#
# (C) Tenable Network Security, Inc.
#
include('compat.inc');
if (description)
{
script_id(131399);
script_version("1.11");
script_set_attribute(attribute:"plugin_modification_date", value:"2024/05/03");
script_cve_id("CVE-2018-0165");
script_bugtraq_id(103568);
script_xref(name:"CISCO-BUG-ID", value:"CSCuw09295");
script_xref(name:"CISCO-BUG-ID", value:"CSCve94496");
script_xref(name:"CISCO-SA", value:"cisco-sa-20180328-igmp");
script_name(english:"Cisco IOS XE Software Internet Group Management Protocol Memory Leak (cisco-sa-20180328-igmp)");
script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco IOS XE Software is affected by a denial of service (DoS) vulnerability in
the Internet Group Management Protocol (IGMP) packet-processing functionality. An unauthenticated, adjacent attacker can
exploit this, by sending a large number of IGMP Membership Query packets containing certain values, to exhaust buffers
on an affected device and cause it to stop responding.
Please see the included Cisco BIDs and Cisco Security Advisory for more information.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
# https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-igmp
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?be52db3c");
script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuw09295");
script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCve94496");
script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID(s) CSCuw09295 and CSCve94496.");
script_set_cvss_base_vector("CVSS2#AV:A/AC:L/Au:N/C:N/I:N/A:C");
script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-0165");
script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
script_set_attribute(attribute:"vuln_publication_date", value:"2018/03/28");
script_set_attribute(attribute:"patch_publication_date", value:"2018/03/28");
script_set_attribute(attribute:"plugin_publication_date", value:"2019/11/29");
script_set_attribute(attribute:"plugin_type", value:"combined");
script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ios_xe");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"CISCO");
script_copyright(english:"This script is Copyright (C) 2019-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("cisco_ios_xe_version.nasl");
script_require_keys("Host/Cisco/IOS-XE/Version");
exit(0);
}
include('cisco_workarounds.inc');
include('ccf.inc');
include('lists.inc');
product_info = cisco::get_product_info(name:'Cisco IOS XE Software');
# Only Cisco Catalyst 4500 Switches with Supervisor Engine 8-E are vulnerable with version 3.x.x.E
version_list_4500 = make_list(
'3.7.0E',
'3.7.1E',
'3.7.2E',
'3.7.3E',
'3.7.4E',
'3.7.5E'
);
version_list_all = make_list(
'16.2.1',
'16.2.2',
'3.8.0E',
'16.3.1',
'16.3.2',
'16.3.3',
'16.3.1a',
'16.4.1',
'16.4.2',
'3.18.3bSP'
);
model = product_info['model'];
show_ver = get_kb_item_or_exit("Host/Cisco/show_ver");
device_model = get_kb_item_or_exit("Host/Cisco/device_model");
if (model =~ "45[0-9]{2}E" && device_model =~ "cat" && "WS-X45-SUP8-E" >< show_ver)
{
cbi = 'CSCuw09295';
version_list = collib::union(version_list_4500, version_list_all);
}
else
{
cbi = 'CSCve94496';
version_list = version_list_all;
}
workarounds = make_list(CISCO_WORKAROUNDS['generic_workaround']);
workaround_params = WORKAROUND_CONFIG['ip_multicast_routing'];
reporting = make_array(
'port' , product_info['port'],
'severity' , SECURITY_WARNING,
'version' , product_info['version'],
'bug_id' , cbi,
'cmds' , make_list('show running-config')
);
cisco::check_and_report(
product_info:product_info,
workarounds:workarounds,
workaround_params:workaround_params,
reporting:reporting,
vuln_versions:version_list
);
CVSS2
Attack Vector
ADJACENT_NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:A/AC:L/Au:N/C:N/I:N/A:C
CVSS3
Attack Vector
ADJACENT
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
EPSS
Percentile
42.0%