CVE-2018-0441
Vulnerability from cvelistv5
Published
2018-10-17 22:00
Modified
2024-09-16 20:32
Severity ?
7.4 (High) - CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Summary
Cisco IOS Access Points Software 802.11r Fast Transition Denial of Service Vulnerability
References
ykramarz@cisco.comhttp://www.securityfocus.com/bid/105680Third Party Advisory, VDB Entry
ykramarz@cisco.comhttp://www.securitytracker.com/id/1041918Third Party Advisory, VDB Entry
ykramarz@cisco.comhttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181017-ap-ft-dosVendor Advisory
Impacted products
CiscoCisco Aironet Access Point Software
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T03:28:10.535Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "105680",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/105680"
          },
          {
            "name": "1041918",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1041918"
          },
          {
            "name": "20181017 Cisco IOS Access Points Software 802.11r Fast Transition Denial of Service Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181017-ap-ft-dos"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Cisco Aironet Access Point Software",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-10-17T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the 802.11r Fast Transition feature set of Cisco IOS Access Points (APs) Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a corruption of certain timer mechanisms triggered by specific roaming events. This corruption will eventually cause a timer crash. An attacker could exploit this vulnerability by sending malicious reassociation events multiple times to the same AP in a short period of time, causing a DoS condition on the affected AP."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-23T09:57:01",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "105680",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/105680"
        },
        {
          "name": "1041918",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1041918"
        },
        {
          "name": "20181017 Cisco IOS Access Points Software 802.11r Fast Transition Denial of Service Vulnerability",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181017-ap-ft-dos"
        }
      ],
      "source": {
        "advisory": "cisco-sa-20181017-ap-ft-dos",
        "defect": [
          [
            "CSCve64652"
          ]
        ],
        "discovery": "INTERNAL"
      },
      "title": "Cisco IOS Access Points Software 802.11r Fast Transition Denial of Service Vulnerability",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@cisco.com",
          "DATE_PUBLIC": "2018-10-17T16:00:00-0500",
          "ID": "CVE-2018-0441",
          "STATE": "PUBLIC",
          "TITLE": "Cisco IOS Access Points Software 802.11r Fast Transition Denial of Service Vulnerability"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Cisco Aironet Access Point Software",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Cisco"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability in the 802.11r Fast Transition feature set of Cisco IOS Access Points (APs) Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a corruption of certain timer mechanisms triggered by specific roaming events. This corruption will eventually cause a timer crash. An attacker could exploit this vulnerability by sending malicious reassociation events multiple times to the same AP in a short period of time, causing a DoS condition on the affected AP."
            }
          ]
        },
        "exploit": [
          {
            "lang": "en",
            "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
          }
        ],
        "impact": {
          "cvss": {
            "baseScore": "7.4",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-400"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "105680",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/105680"
            },
            {
              "name": "1041918",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1041918"
            },
            {
              "name": "20181017 Cisco IOS Access Points Software 802.11r Fast Transition Denial of Service Vulnerability",
              "refsource": "CISCO",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181017-ap-ft-dos"
            }
          ]
        },
        "source": {
          "advisory": "cisco-sa-20181017-ap-ft-dos",
          "defect": [
            [
              "CSCve64652"
            ]
          ],
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2018-0441",
    "datePublished": "2018-10-17T22:00:00Z",
    "dateReserved": "2017-11-27T00:00:00",
    "dateUpdated": "2024-09-16T20:32:14.188Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2018-0441\",\"sourceIdentifier\":\"ykramarz@cisco.com\",\"published\":\"2018-10-17T22:29:00.550\",\"lastModified\":\"2019-10-09T23:32:05.397\",\"vulnStatus\":\"Modified\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability in the 802.11r Fast Transition feature set of Cisco IOS Access Points (APs) Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a corruption of certain timer mechanisms triggered by specific roaming events. This corruption will eventually cause a timer crash. An attacker could exploit this vulnerability by sending malicious reassociation events multiple times to the same AP in a short period of time, causing a DoS condition on the affected AP.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad en el conjunto de caracter\u00edsticas 802.11r Fast Transition en Cisco IOS Access Points (APs) Software podr\u00eda permitir que un atacante adyacente sin autenticar provoque una denegaci\u00f3n de servicio (DoS) en un dispositivo afectado. La vulnerabilidad se debe a la corrupci\u00f3n de ciertos mecanismos de temporizaci\u00f3n desencadenados por eventos concretos de roaming. Esta corrupci\u00f3n acabar\u00e1 provocando un cierre inesperado del temporizador. Un atacante podr\u00eda explotar esta vulnerabilidad enviando eventos maliciosos de reasociaci\u00f3n m\u00faltiples veces al mismo AP en un corto espacio de tiempo, lo que provoca una condici\u00f3n de denegaci\u00f3n de servicio (DoS) en el AP afectado.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\",\"baseScore\":7.4,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":4.0},{\"source\":\"ykramarz@cisco.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\",\"baseScore\":7.4,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":4.0}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:A/AC:L/Au:N/C:N/I:N/A:C\",\"accessVector\":\"ADJACENT_NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"COMPLETE\",\"baseScore\":6.1},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":6.5,\"impactScore\":6.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-400\"}]},{\"source\":\"ykramarz@cisco.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-400\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:access_points:8.0\\\\(140.0\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2A2819B0-F330-4842-A71E-B0BADF999FEF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:access_points:8.2\\\\(141.0\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6E8217BA-0CEC-4E93-853E-EE86C2118954\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:access_points:8.2\\\\(151.0\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F92DE6E7-FFCA-4206-8C40-124A243778A9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:access_points:8.3\\\\(102.0\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"67AA1EAD-5FD9-44F0-836E-16D93E7D8D02\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:access_points:8.3\\\\(112.0\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"32A6643B-AAB1-4D92-82CE-1F369FDFB796\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:access_points:8.3\\\\(114.74\\\\):*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D16FE04-C08A-44B8-9EB3-D6C1E2E117DB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:access_points:15.3\\\\(3\\\\)jd:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2AF5D480-A6E6-4933-BDA8-782C71D8EA67\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:access_points:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"8.3.140.0\",\"matchCriteriaId\":\"27B3BAA1-C708-40E2-8C2F-42EA78825B8D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:cisco:access_points:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.4\",\"versionEndExcluding\":\"8.5.110.0\",\"matchCriteriaId\":\"19F09BB9-D027-40C7-8D49-3AEC96C530EA\"}]}]}],\"references\":[{\"url\":\"http://www.securityfocus.com/bid/105680\",\"source\":\"ykramarz@cisco.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securitytracker.com/id/1041918\",\"source\":\"ykramarz@cisco.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181017-ap-ft-dos\",\"source\":\"ykramarz@cisco.com\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.