Product:
Cisco IOS
Summary
A vulnerability in the UDP processing code of Cisco IOS could allow an unauthenticated, remote attacker to cause the input queue of an affected system to hold UDP packets, leading to a denial of service condition. This issue arises from changes in the Cisco IOS Software that create UDP sockets and leave them idle without closing. An attacker can exploit this vulnerability by sending UDP packets with a destination port of 0 to an affected device.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.5 | CVE-2017-6627 |
Exploitation
To exploit this vulnerability, an attacker needs to send specially crafted UDP packets with a destination port of 0 to the affected device. If successful, the attacker can cause the input interface queue to hold these UDP packets, resulting in a denial of service condition. The input interface queue will stop holding UDP packets once it receives 250 packets, which can disrupt normal operations.
Affected Products
- Cisco IOS 15.1: Affected by the vulnerability in UDP processing.
- Cisco IOS 15.2: Affected by the vulnerability in UDP processing.
- Cisco IOS 15.4: Affected by the vulnerability in UDP processing.
- Cisco IOS XE 3.14: Affected by the vulnerability in UDP processing.
- Cisco IOS XE 3.15: Affected by the vulnerability in UDP processing.
- Cisco IOS XE 3.16: Affected by the vulnerability in UDP processing.
- Cisco IOS XE 3.17: Affected by the vulnerability in UDP processing.
- Cisco IOS XE 3.18: Affected by the vulnerability in UDP processing.
Mitigation
To mitigate this vulnerability, it is recommended to apply updates as per the vendor’s instructions. Keeping the software up to date will help protect against potential exploits.