cnvd - cnvd-2018-21194

cnvd-2018-21194

Vulnerability from cnvd

Title: Cisco Wireless LAN Controller Software Control and Provisioning of Wireless Access Points Protocol信息泄露漏洞

Description:

Cisco Wireless LAN Controller（WLC）是美国思科（Cisco）公司的一款无线局域网控制器产品。该产品在无线局域网中提供安全策略、入侵检测等功能。

Cisco Wireless LAN Controller Software Control and Provisioning of Wireless Access Points Protocol存在信息泄露漏洞，该漏洞是由于处理CAPWAP keepalive请求的代码部分中的条件未进行充分检查。攻击者利用此漏洞可以通过向易受攻击的Cisco WLC设备发送精心设计的CAPWAP keepalive数据包。成功利用可能允许攻击者检索设备内存的内容，这可能导致机密信息的泄露。

Severity: 高

Patch Name: Cisco Wireless LAN Controller Software Control and Provisioning of Wireless Access Points Protocol信息泄露漏洞的补丁

Patch Description:

Cisco Wireless LAN Controller（WLC）是美国思科（Cisco）公司的一款无线局域网控制器产品。该产品在无线局域网中提供安全策略、入侵检测等功能。

Formal description:

思科发布了解决此漏洞的软件更新： https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181017-wlc-capwap-memory-leak

Reference: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181017-wlc-capwap-memory-leak

Impacted products

Name
['Cisco Wireless LAN Controller', 'Cisco Provisioning of Wireless Access Points Protocol']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-0442"
    }
  },
  "description": "Cisco Wireless LAN Controller\uff08WLC\uff09\u662f\u7f8e\u56fd\u601d\u79d1\uff08Cisco\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u65e0\u7ebf\u5c40\u57df\u7f51\u63a7\u5236\u5668\u4ea7\u54c1\u3002\u8be5\u4ea7\u54c1\u5728\u65e0\u7ebf\u5c40\u57df\u7f51\u4e2d\u63d0\u4f9b\u5b89\u5168\u7b56\u7565\u3001\u5165\u4fb5\u68c0\u6d4b\u7b49\u529f\u80fd\u3002\r\n\r\nCisco Wireless LAN Controller Software Control and Provisioning of Wireless Access Points Protocol\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u662f\u7531\u4e8e\u5904\u7406CAPWAP keepalive\u8bf7\u6c42\u7684\u4ee3\u7801\u90e8\u5206\u4e2d\u7684\u6761\u4ef6\u672a\u8fdb\u884c\u5145\u5206\u68c0\u67e5\u3002\u653b\u51fb\u8005\u5229\u7528\u6b64\u6f0f\u6d1e\u53ef\u4ee5\u901a\u8fc7\u5411\u6613\u53d7\u653b\u51fb\u7684Cisco WLC\u8bbe\u5907\u53d1\u9001\u7cbe\u5fc3\u8bbe\u8ba1\u7684CAPWAP keepalive\u6570\u636e\u5305\u3002\u6210\u529f\u5229\u7528\u53ef\u80fd\u5141\u8bb8\u653b\u51fb\u8005\u68c0\u7d22\u8bbe\u5907\u5185\u5b58\u7684\u5185\u5bb9\uff0c\u8fd9\u53ef\u80fd\u5bfc\u81f4\u673a\u5bc6\u4fe1\u606f\u7684\u6cc4\u9732\u3002",
  "discovererName": "Cisco",
  "formalWay": "\u601d\u79d1\u53d1\u5e03\u4e86\u89e3\u51b3\u6b64\u6f0f\u6d1e\u7684\u8f6f\u4ef6\u66f4\u65b0\uff1a\r\nhttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181017-wlc-capwap-memory-leak",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-21194",
  "openTime": "2018-10-18",
  "patchDescription": "Cisco Wireless LAN Controller\uff08WLC\uff09\u662f\u7f8e\u56fd\u601d\u79d1\uff08Cisco\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u65e0\u7ebf\u5c40\u57df\u7f51\u63a7\u5236\u5668\u4ea7\u54c1\u3002\u8be5\u4ea7\u54c1\u5728\u65e0\u7ebf\u5c40\u57df\u7f51\u4e2d\u63d0\u4f9b\u5b89\u5168\u7b56\u7565\u3001\u5165\u4fb5\u68c0\u6d4b\u7b49\u529f\u80fd\u3002\r\n\r\nCisco Wireless LAN Controller Software Control and Provisioning of Wireless Access Points Protocol\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u662f\u7531\u4e8e\u5904\u7406CAPWAP keepalive\u8bf7\u6c42\u7684\u4ee3\u7801\u90e8\u5206\u4e2d\u7684\u6761\u4ef6\u672a\u8fdb\u884c\u5145\u5206\u68c0\u67e5\u3002\u653b\u51fb\u8005\u5229\u7528\u6b64\u6f0f\u6d1e\u53ef\u4ee5\u901a\u8fc7\u5411\u6613\u53d7\u653b\u51fb\u7684Cisco WLC\u8bbe\u5907\u53d1\u9001\u7cbe\u5fc3\u8bbe\u8ba1\u7684CAPWAP keepalive\u6570\u636e\u5305\u3002\u6210\u529f\u5229\u7528\u53ef\u80fd\u5141\u8bb8\u653b\u51fb\u8005\u68c0\u7d22\u8bbe\u5907\u5185\u5b58\u7684\u5185\u5bb9\uff0c\u8fd9\u53ef\u80fd\u5bfc\u81f4\u673a\u5bc6\u4fe1\u606f\u7684\u6cc4\u9732\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Cisco Wireless LAN Controller Software Control and Provisioning of Wireless Access Points Protocol\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Cisco Wireless LAN Controller",
      "Cisco Provisioning of Wireless Access Points Protocol"
    ]
  },
  "referenceLink": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181017-wlc-capwap-memory-leak",
  "serverity": "\u9ad8",
  "submitTime": "2018-10-18",
  "title": "Cisco Wireless LAN Controller Software Control and Provisioning of Wireless Access Points Protocol\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e"
}

CVE-2018-0442 (GCVE-0-2018-0442)

Vulnerability from cvelistv5

Published

2018-10-17 22:00

Modified

2024-11-26 14:24

Severity ?

7.5 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-200

Summary

A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol component of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to retrieve memory contents, which could lead to the disclosure of confidential information. The vulnerability is due to insufficient condition checks in the part of the code that handles CAPWAP keepalive requests. An attacker could exploit this vulnerability by sending a crafted CAPWAP keepalive packet to a vulnerable Cisco WLC device. A successful exploit could allow the attacker to retrieve the contents of device memory, which could lead to the disclosure of confidential information.

References

▼	URL	Tags
	http://www.securitytracker.com/id/1041923	vdb-entry, x_refsource_SECTRACK
	http://www.securityfocus.com/bid/105664	vdb-entry, x_refsource_BID
	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181017-wlc-capwap-memory-leak	vendor-advisory, x_refsource_CISCO

Impacted products

	Vendor	Product	Version
	Cisco	Cisco Wireless LAN Controller (WLC)	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T03:28:10.943Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "1041923",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1041923"
          },
          {
            "name": "105664",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/105664"
          },
          {
            "name": "20181017 Cisco Wireless LAN Controller Software Control and Provisioning of Wireless Access Points Protocol Information Disclosure Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181017-wlc-capwap-memory-leak"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2018-0442",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-25T18:52:50.623263Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-26T14:24:00.440Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Cisco Wireless LAN Controller (WLC)",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-10-17T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol component of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to retrieve memory contents, which could lead to the disclosure of confidential information. The vulnerability is due to insufficient condition checks in the part of the code that handles CAPWAP keepalive requests. An attacker could exploit this vulnerability by sending a crafted CAPWAP keepalive packet to a vulnerable Cisco WLC device. A successful exploit could allow the attacker to retrieve the contents of device memory, which could lead to the disclosure of confidential information."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-19T09:57:01",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "1041923",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1041923"
        },
        {
          "name": "105664",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/105664"
        },
        {
          "name": "20181017 Cisco Wireless LAN Controller Software Control and Provisioning of Wireless Access Points Protocol Information Disclosure Vulnerability",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181017-wlc-capwap-memory-leak"
        }
      ],
      "source": {
        "advisory": "cisco-sa-20181017-wlc-capwap-memory-leak",
        "defect": [
          [
            "CSCvf66680"
          ]
        ],
        "discovery": "INTERNAL"
      },
      "title": "Cisco Wireless LAN Controller Software Control and Provisioning of Wireless Access Points Protocol Information Disclosure Vulnerability",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@cisco.com",
          "DATE_PUBLIC": "2018-10-17T16:00:00-0500",
          "ID": "CVE-2018-0442",
          "STATE": "PUBLIC",
          "TITLE": "Cisco Wireless LAN Controller Software Control and Provisioning of Wireless Access Points Protocol Information Disclosure Vulnerability"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Cisco Wireless LAN Controller (WLC)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Cisco"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol component of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to retrieve memory contents, which could lead to the disclosure of confidential information. The vulnerability is due to insufficient condition checks in the part of the code that handles CAPWAP keepalive requests. An attacker could exploit this vulnerability by sending a crafted CAPWAP keepalive packet to a vulnerable Cisco WLC device. A successful exploit could allow the attacker to retrieve the contents of device memory, which could lead to the disclosure of confidential information."
            }
          ]
        },
        "exploit": [
          {
            "lang": "en",
            "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
          }
        ],
        "impact": {
          "cvss": {
            "baseScore": "7.5",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-200"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "1041923",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1041923"
            },
            {
              "name": "105664",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/105664"
            },
            {
              "name": "20181017 Cisco Wireless LAN Controller Software Control and Provisioning of Wireless Access Points Protocol Information Disclosure Vulnerability",
              "refsource": "CISCO",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181017-wlc-capwap-memory-leak"
            }
          ]
        },
        "source": {
          "advisory": "cisco-sa-20181017-wlc-capwap-memory-leak",
          "defect": [
            [
              "CSCvf66680"
            ]
          ],
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2018-0442",
    "datePublished": "2018-10-17T22:00:00Z",
    "dateReserved": "2017-11-27T00:00:00",
    "dateUpdated": "2024-11-26T14:24:00.440Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted