CVE-2018-0155 : What You Need to Know

A vulnerability in the implementation of the Bidirectional Forwarding Detection (BFD) offload on Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches could allow a remote attacker to crash the iosd process, leading to a denial of service (DoS) situation. The vulnerability arises from inadequate error handling when the BFD header in a BFD packet is incomplete.

Understanding CVE-2018-0155

This CVE entry describes a vulnerability in Cisco Catalyst 4500 Series and 4500-X Series Switches that could be exploited by a remote attacker to cause a denial of service by crashing the iosd process.

What is CVE-2018-0155?

The vulnerability in the Bidirectional Forwarding Detection (BFD) offload implementation on Cisco Catalyst 4500 Series and 4500-X Series Switches allows an unauthenticated attacker to trigger a system reload by sending a manipulated BFD message.

The Impact of CVE-2018-0155

A remote attacker can crash the iosd process, leading to a denial of service (DoS) situation.
Successful exploitation could result in a system reload, disrupting network operations.

Technical Details of CVE-2018-0155

This section provides technical details of the vulnerability.

Vulnerability Description

The vulnerability is caused by insufficient error handling when the BFD header in a BFD packet is incomplete.

Affected Systems and Versions

The following models are affected:

Catalyst 4500 Supervisor Engine 6-E (K5)
Catalyst 4500 Supervisor Engine 6L-E (K10)
Catalyst 4500 Supervisor Engine 7-E (K10)
Catalyst 4500 Supervisor Engine 7L-E (K10)
Catalyst 4500E Supervisor Engine 8-E (K10)
Catalyst 4500E Supervisor Engine 8L-E (K10)
Catalyst 4500E Supervisor Engine 9-E (K10)
Catalyst 4500-X Series Switches (K10)
Catalyst 4900M Switch (K5)
Catalyst 4948E Ethernet Switch (K5)

Exploitation Mechanism

To exploit the vulnerability, the attacker needs to send a crafted BFD message to the affected switch or across it, triggering a system reload.

Mitigation and Prevention

Steps to mitigate and prevent exploitation of CVE-2018-0155.

Immediate Steps to Take

Apply the necessary patches provided by Cisco to address the vulnerability.
Monitor network traffic for any signs of exploitation.

Long-Term Security Practices

Regularly update and patch network devices to protect against known vulnerabilities.
Implement network segmentation to limit the impact of potential attacks.

Patching and Updates

Cisco has released patches to address the vulnerability. Ensure timely application of these patches to secure the network.