[SingCERT] Alert on Cisco Security Updates (CVE-2018-0369 & CVE-2018-0341)
13 July 2018
Cisco has announced the release of several security updates to address vulnerabilities affecting its operating system and other products.
Two high-severity vulnerabilities were identified which require immediate attention.
CVE-2018-0369 is an IPv4 fragmentation denial of service (DoS) vulnerability affecting Cisco products running on StarOS. StarOS powers next generation mobile networks which support everything from tablets and smartphones to IoT deployments. StarOS gives users the flexibility and dynamic resource allocation for mobile services and networks. This vulnerability can be exploited by sending malicious IPv4 packets across an affected device. An exploit could allow an unauthenticated, remote explorer to trigger a reload of the npusim process, resulting in a DoS condition and possible service disruptions.
CVE-2018-0341 is a web-based user interface (UI) command injection vulnerability affecting Cisco IP Phone 6800, 7800, and 8800 series with Multiplatform Firmware. The vulnerability can be triggered by remotely executing commands with the privileges of the web server. Successful attackers can then eavesdrop on conversations, intercept rich media data, place phone calls and more.