CVE-2018-0252: cisco wireless_lan_controller_software Resource Management Errors

Vulnerability summary

CVE-2018-0252 is a high (CVSS 8.6) Resource Management Errors vulnerability in cisco wireless_lan_controller_software. EPSS estimates a 2.35% chance of exploitation in the next 30 days, higher than 83.4% of scored vulnerabilities.

Timeline

1. 02-05-2018
   PublishedVulnerability first disclosed.
2. 29-11-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in the IP Version 4 (IPv4) fragment reassembly function of Cisco 3500, 5500, and 8500 Series Wireless LAN Controller Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. The vulnerability is due to a corruption of an internal data structure process that occurs when the affected software reassembles certain IPv4 packets. An attacker could exploit this vulnerability by sending certain malformed IPv4 fragments to an affected device. A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition. This vulnerability affects all releases of 8.4 until the first fixed release for the 5500 and 8500 Series Wireless LAN Controllers and releases 8.5.103.0 and 8.5.105.0 for the 3500, 5500, and 8500 Series Wireless LAN Controllers. Cisco Bug IDs: CSCvf89222.

• CWE-399Resource Management ErrorsWeaknesses in this category are related to improper management of system resources.
• CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.