Guest

Preview Tool

Cisco Bug: CSCuy82806 - Cisco IOS and IOS XE Software OSPFv3 Denial of Service Vulnerability

Last Modified

Jul 19, 2020

Products (112)

  • Cisco IOS
  • Cisco Catalyst 3850-24P-L Switch
  • Cisco Catalyst 3650-48FQ-E Switch
  • Cisco Catalyst 3850-48XS-F-S Switch
  • Cisco Catalyst 3650-24TD-S Switch
  • Cisco Catalyst 3850-48XS-E Switch
  • Cisco Catalyst 3650-48TQ-L Switch
  • Cisco Catalyst 3650-48FQM-L Switch
  • Cisco Catalyst 3850-12S-E Switch
  • Cisco Catalyst 3650-24PDM-E Switch
View all products in Bug Search Tool Login Required

Known Affected Releases

16.2.1

Description (partial)

<B>Symptom:</B>
A vulnerability in the Open Shortest Path First version 3 (OSPFv3) implementation in Cisco IOS and IOS XE Software could allow an unauthenticated, adjacent attacker to cause an affected device to reload.

The vulnerability is due to incorrect handling of specific OSPFv3 packets. An attacker could exploit this vulnerability by sending crafted OSPFv3 Link-State Advertisements (LSA) to an affected device. An exploit could allow the attacker to cause an affected device to reload, leading to a denial of service (DoS) condition.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-ospfv3-dos
This advisory is part of the September 26, 2018, release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication, which includes 12 Cisco Security Advisories that describe 13 vulnerabilities. For a complete list of the advisories and links to them, see Cisco Event Response: September 2018 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication - http://tools.cisco.com/security/center/viewErp.x?alertId=ERP-69981

<B>Conditions:</B>
See Affected Products Section of the Advisory.

To determine whether a release is affected by any published Cisco Security Advisory, use the Cisco IOS Software Checker on Cisco.com at the following link: https://tools.cisco.com/security/center/softwarechecker.x
Bug details contain sensitive information and therefore require a Cisco.com account to be viewed.

Bug Details Include

  • Full Description (including symptoms, conditions and workarounds)
  • Status
  • Severity
  • Known Fixed Releases
  • Related Community Discussions
  • Number of Related Support Cases
Bug information is viewable for customers and partners who have a service contract. Registered users can view up to 200 bugs per month without a service contract.