cnvd - cnvd-2018-16178

cnvd-2018-16178

Vulnerability from cnvd

Title: Cisco Small Business 100 Series Wireless Access Points和Small Business 300 Series Wireless Access Points拒绝服务漏洞

Description:

Cisco Small Business 100 Series Wireless Access Points和Small Business 300 Series Wireless Access Points都是美国思科（Cisco）公司的不同系列的无线接入点产品，它提供高容量的无线局域网和访客接入服务等功能。

Cisco Small Business 100 Series Wireless Access Points和Small Business 300 Series Wireless Access Points中的Extensible Authentication Protocol over LAN (EAPOL)功能的实现存在拒绝服务漏洞，该漏洞源于程序未正确地处理EAPOL帧。攻击者可通过向受影响的设备发送特制的EAPOL帧利用该漏洞造成拒绝服务。

Severity: 中

Patch Name: Cisco Small Business 100 Series Wireless Access Points和Small Business 300 Series Wireless Access Points拒绝服务漏洞的补丁

Patch Description:

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新： https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvj97472

Reference: https://nvd.nist.gov/vuln/detail/CVE-2018-0415

Impacted products

Name
['Cisco Small Business 100 Series Wireless Access Points', 'Cisco Small Business 300 Series Wireless Access Points']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "105116"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-0415"
    }
  },
  "description": "Cisco Small Business 100 Series Wireless Access Points\u548cSmall Business 300 Series Wireless Access Points\u90fd\u662f\u7f8e\u56fd\u601d\u79d1\uff08Cisco\uff09\u516c\u53f8\u7684\u4e0d\u540c\u7cfb\u5217\u7684\u65e0\u7ebf\u63a5\u5165\u70b9\u4ea7\u54c1\uff0c\u5b83\u63d0\u4f9b\u9ad8\u5bb9\u91cf\u7684\u65e0\u7ebf\u5c40\u57df\u7f51\u548c\u8bbf\u5ba2\u63a5\u5165\u670d\u52a1\u7b49\u529f\u80fd\u3002\r\n\r\nCisco Small Business 100 Series Wireless Access Points\u548cSmall Business 300 Series Wireless Access Points\u4e2d\u7684Extensible Authentication Protocol over LAN (EAPOL)\u529f\u80fd\u7684\u5b9e\u73b0\u5b58\u5728\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u6b63\u786e\u5730\u5904\u7406EAPOL\u5e27\u3002\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u5411\u53d7\u5f71\u54cd\u7684\u8bbe\u5907\u53d1\u9001\u7279\u5236\u7684EAPOL\u5e27\u5229\u7528\u8be5\u6f0f\u6d1e\u9020\u6210\u62d2\u7edd\u670d\u52a1\u3002",
  "discovererName": "Cisco",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://bst.cloudapps.cisco.com/bugsearch/bug/CSCvj97472",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-16178",
  "openTime": "2018-08-24",
  "patchDescription": "Cisco Small Business 100 Series Wireless Access Points\u548cSmall Business 300 Series Wireless Access Points\u90fd\u662f\u7f8e\u56fd\u601d\u79d1\uff08Cisco\uff09\u516c\u53f8\u7684\u4e0d\u540c\u7cfb\u5217\u7684\u65e0\u7ebf\u63a5\u5165\u70b9\u4ea7\u54c1\uff0c\u5b83\u63d0\u4f9b\u9ad8\u5bb9\u91cf\u7684\u65e0\u7ebf\u5c40\u57df\u7f51\u548c\u8bbf\u5ba2\u63a5\u5165\u670d\u52a1\u7b49\u529f\u80fd\u3002\r\n\r\nCisco Small Business 100 Series Wireless Access Points\u548cSmall Business 300 Series Wireless Access Points\u4e2d\u7684Extensible Authentication Protocol over LAN (EAPOL)\u529f\u80fd\u7684\u5b9e\u73b0\u5b58\u5728\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u6b63\u786e\u5730\u5904\u7406EAPOL\u5e27\u3002\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u5411\u53d7\u5f71\u54cd\u7684\u8bbe\u5907\u53d1\u9001\u7279\u5236\u7684EAPOL\u5e27\u5229\u7528\u8be5\u6f0f\u6d1e\u9020\u6210\u62d2\u7edd\u670d\u52a1\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Cisco Small Business 100 Series Wireless Access Points\u548cSmall Business 300 Series Wireless Access Points\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Cisco Small Business 100 Series Wireless Access Points",
      "Cisco Small Business 300 Series Wireless Access Points"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2018-0415",
  "serverity": "\u4e2d",
  "submitTime": "2018-08-17",
  "title": "Cisco Small Business 100 Series Wireless Access Points\u548cSmall Business 300 Series Wireless Access Points\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e"
}

CVE-2018-0415 (GCVE-0-2018-0415)

Vulnerability from cvelistv5

Published

2018-08-15 20:00

Modified

2024-11-26 14:47

Severity ?

CWE

CWE-388

Summary

A vulnerability in the implementation of Extensible Authentication Protocol over LAN (EAPOL) functionality in Cisco Small Business 100 Series Wireless Access Points and Cisco Small Business 300 Series Wireless Access Points could allow an authenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to the improper processing of certain EAPOL frames. An attacker could exploit this vulnerability by sending a stream of crafted EAPOL frames to an affected device. A successful exploit could allow the attacker to force the access point (AP) to disassociate all the associated stations (STAs) and to disallow future, new association requests. Cisco Bug IDs: CSCvj97472.

References

▼	URL	Tags
	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180815-csb-wap-dos	vendor-advisory, x_refsource_CISCO
	http://www.securityfocus.com/bid/105116	vdb-entry, x_refsource_BID

Impacted products

Vendor

Product

Version

▼

Cisco Systems, Inc.

Small Business 100 Series Wireless Access Points

Version: unspecified

Cisco Systems, Inc.

Small Business 300 Series Wireless Access Points

Version: unspecified

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T03:21:15.471Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20180815 Cisco Small Business 100 Series and 300 Series Wireless Access Points Denial of Service Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180815-csb-wap-dos"
          },
          {
            "name": "105116",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/105116"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2018-0415",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-25T18:48:43.846220Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-26T14:47:42.201Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Small Business 100 Series Wireless Access Points",
          "vendor": "Cisco Systems, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified"
            }
          ]
        },
        {
          "product": "Small Business 300 Series Wireless Access Points",
          "vendor": "Cisco Systems, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified"
            }
          ]
        }
      ],
      "datePublic": "2018-08-15T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the implementation of Extensible Authentication Protocol over LAN (EAPOL) functionality in Cisco Small Business 100 Series Wireless Access Points and Cisco Small Business 300 Series Wireless Access Points could allow an authenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to the improper processing of certain EAPOL frames. An attacker could exploit this vulnerability by sending a stream of crafted EAPOL frames to an affected device. A successful exploit could allow the attacker to force the access point (AP) to disassociate all the associated stations (STAs) and to disallow future, new association requests. Cisco Bug IDs: CSCvj97472."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-388",
              "description": "CWE-388",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-08-22T09:57:01",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "20180815 Cisco Small Business 100 Series and 300 Series Wireless Access Points Denial of Service Vulnerability",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180815-csb-wap-dos"
        },
        {
          "name": "105116",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/105116"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@cisco.com",
          "DATE_PUBLIC": "2018-08-15T00:00:00",
          "ID": "CVE-2018-0415",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Small Business 100 Series Wireless Access Points",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "unspecified"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Small Business 300 Series Wireless Access Points",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "unspecified"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Cisco Systems, Inc."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability in the implementation of Extensible Authentication Protocol over LAN (EAPOL) functionality in Cisco Small Business 100 Series Wireless Access Points and Cisco Small Business 300 Series Wireless Access Points could allow an authenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to the improper processing of certain EAPOL frames. An attacker could exploit this vulnerability by sending a stream of crafted EAPOL frames to an affected device. A successful exploit could allow the attacker to force the access point (AP) to disassociate all the associated stations (STAs) and to disallow future, new association requests. Cisco Bug IDs: CSCvj97472."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-388"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20180815 Cisco Small Business 100 Series and 300 Series Wireless Access Points Denial of Service Vulnerability",
              "refsource": "CISCO",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180815-csb-wap-dos"
            },
            {
              "name": "105116",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/105116"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2018-0415",
    "datePublished": "2018-08-15T20:00:00Z",
    "dateReserved": "2017-11-27T00:00:00",
    "dateUpdated": "2024-11-26T14:47:42.201Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted