CVE-2018-0298
Description
A vulnerability in the web UI of Cisco FXOS and Cisco UCS Fabric Interconnect Software could allow an unauthenticated, remote attacker to cause a buffer overflow on an affected system. The vulnerability is due to incorrect input validation in the web UI. An attacker could exploit this vulnerability by sending a malicious HTTP or HTTPS packet directed to the physical management interface of an affected system. A successful exploit could allow the attacker to cause the process to crash and possibly reload the device, resulting in a denial of service (DoS) condition on the affected system. This vulnerability affects Firepower 4100 Series Next-Generation Firewall, Firepower 9300 Security Appliance, UCS 6200 Series Fabric Interconnects, UCS 6300 Series Fabric Interconnects. Cisco Bug IDs: CSCvb61398, CSCvb86799.
How to fix
- cisco firepower_extensible_operating_system1.1.4.169, 2.0.1.135, 1.1.4.179, 2.0.1.153 or later
- cisco nx-os3.1\(3a\)a or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco firepower_extensible_operating_system | 1.1 ≤ v < 1.1.4.169, 2.0 ≤ v < 2.0.1.135, 1.1 ≤ v < 1.1.4.179, 2.0 ≤ v < 2.0.1.153 | 1.1.4.169, 2.0.1.135, 1.1.4.179, 2.0.1.153 |
| cisco nx-os | 3.0\(2\) ≤ v < 3.1\(3a\)a | 3.1\(3a\)a |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.