NVD Vulnerability Detail

CVE-2018-0472

Summary	A vulnerability in the IPsec driver code of multiple Cisco IOS XE Software platforms and the Cisco ASA 5500-X Series Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause the device to reload. The vulnerability is due to improper processing of malformed IPsec Authentication Header (AH) or Encapsulating Security Payload (ESP) packets. An attacker could exploit this vulnerability by sending malformed IPsec packets to be processed by an affected device. An exploit could allow the attacker to cause a reload of the affected device.
Publication Date	Oct. 5, 2018, 11:29 p.m.
Registration Date	March 1, 2021, 6:36 p.m.
Last Update	Nov. 21, 2024, 12:38 p.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://www.securityfocus.com/bid/105418	Third Party Advisory VDB Entry
2	http://www.securityfocus.com/bid/105418	Third Party Advisory VDB Entry
3	http://www.securitytracker.com/id/1041735	Third Party Advisory VDB Entry
4	http://www.securitytracker.com/id/1041735	Third Party Advisory VDB Entry
5	http://www.securitytracker.com/id/1041737	Third Party Advisory VDB Entry
6	http://www.securitytracker.com/id/1041737	Third Party Advisory VDB Entry
7	https://ics-cert.us-cert.gov/advisories/ICSA-19-094-04
8	https://ics-cert.us-cert.gov/advisories/ICSA-19-094-04
9	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-ipsec	Vendor Advisory
10	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-ipsec	Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-20	不適切な入力確認	https://cwe.mitre.org/data/definitions/20.html

JVN Vulnerability Information

Cisco IOS XE ソフトウェアプラットフォームおよび Cisco ASA 5500-X Series Adaptive Security Appliance における入力確認に関する脆弱性

Title	Cisco IOS XE ソフトウェアプラットフォームおよび Cisco ASA 5500-X Series Adaptive Security Appliance における入力確認に関する脆弱性
Summary	Cisco IOS XE ソフトウェアプラットフォームおよび Cisco ASA 5500-X Series Adaptive Security Appliance (ASA) には、入力確認に関する脆弱性が存在します。
Possible impacts	サービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Sept. 26, 2018, midnight
Registration Date	Jan. 17, 2019, 12:07 p.m.
Last Update	April 10, 2019, 4:41 p.m.

Affected System

シスコシステムズ

Cisco IOS XE

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2018-0472	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0472
2	CVE-2018-0472	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0472
National Vulnerability Database (NVD)
3	CVE-2018-0472	https://nvd.nist.gov/vuln/detail/CVE-2018-0472
4	CVE-2018-0472	https://nvd.nist.gov/vuln/detail/CVE-2018-0472

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html
2	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html

ベンダー情報

No	Name	URL
Cisco Security Advisory
1	cisco-sa-20180926-ipsec	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-ipsec
2	cisco-sa-20180926-ipsec	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-ipsec

その他

No	Name	URL
ICS-CERT ADVISORY
1	ICSA-19-094-04	https://ics-cert.us-cert.gov/advisories/ICSA-19-094-04
2	ICSA-19-094-04	https://ics-cert.us-cert.gov/advisories/ICSA-19-094-04

Change Log

No	Changed Details	Date of change
1	[2019年01月17日] 掲載	Jan. 17, 2019, 12:07 p.m.
2	[2019年04月10日] 参考情報：ICS-CERT ADVISORY (ICSA-19-094-04) を追加	April 10, 2019, 4:39 p.m.
1	[2019年01月17日] 掲載	Jan. 17, 2019, 12:07 p.m.
2	[2019年04月10日] 参考情報：ICS-CERT ADVISORY (ICSA-19-094-04) を追加	April 10, 2019, 4:39 p.m.