[c-nsp] Cisco Security Advisory: Cisco NetFlow Generation Appliance Stream Control Transmission Protocol Denial of Service Vulnerability

[psirt at cisco.com]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Cisco Security Advisory: Cisco NetFlow Generation Appliance Stream Control Transmission Protocol Denial of Service Vulnerability

Advisory ID: cisco-sa-20170301-nga

Revision: 1.0

For Public Release: 2017 March 1 16:00 GMT

Last Updated: 2017 March 1 16:00 GMT

CVE ID(s): CVE-2017-3826

CVSS Score v(3): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

+---------------------------------------------------------------------

Summary
=======
A vulnerability in the Stream Control Transmission Protocol (SCTP) decoder of the Cisco NetFlow Generation Appliance (NGA) could allow an unauthenticated, remote attacker to cause the device to hang or unexpectedly reload, causing a denial of service (DoS) condition.

The vulnerability is due to incomplete validation of SCTP packets being monitored on the NGA data ports. An attacker could exploit this vulnerability by sending malformed SCTP packets on a network that is monitored by an NGA data port. SCTP packets addressed to the IP address of the NGA itself will not trigger this vulnerability. An exploit could allow the attacker to cause the appliance to become unresponsive or reload, causing a DoS condition. User interaction could be needed to recover the device using the reboot command from the CLI.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170301-nga ["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170301-nga"]

-----BEGIN PGP SIGNATURE-----

iQKBBAEBAgBrBQJYtvI1ZBxDaXNjbyBTeXN0ZW1zIFByb2R1Y3QgU2VjdXJpdHkg
SW5jaWRlbnQgUmVzcG9uc2UgVGVhbSAoQ2lzY28gUFNJUlQga2V5IDIwMTYtMjAx
NykgPHBzaXJ0QGNpc2NvLmNvbT4ACgkQrz2APcQAkHm2xw//eHO+NMJS5cBL96AS
ZM5+iBklbXx7nRNUYrGLVimThNBtnTbKf4QvobIGN1RtMNXBH1BmAjnRPHtcqQvf
dUS+8paOfUYMTuwIRaxn6K3URk2+6/2skn4Gnf7IE8GVOuHqadevW+95daC8MFPc
hJok69tJ7he3TkQb9fljs4nENT50OUrhgS3rILGI6hIHjB51ENxMq8w66C/eoWif
GsIk878tPDmnBCABXiLA4SCjyxCrooXHon40X3URl7+Dhk1Pty0WuZ51B/5udoJJ
LskVC372evIUjYD2sUTNnup6A8nKBj0Yl0TTWA8GhPz3CJxXvJRld6LEL/Jfl+AO
LMkfgCIu5Ob0M6wtwvPZPsEXjmk9dYVr1t0UDGRI9KSNZ0qwz1YMeURJ/Ee0cSk8
1csurLIJwWodkCu/MDzXDgzUhXeICtsvh4FLIHxWT/qKYxEM9/cTTNUyfMmOFv5+
9+xOviOv7mTwEv//cKGppNKqiYaWDCOiDu2aXq758tklPbJP73HAOz3sX5epglQz
AZ0SxzGYtn7sZyt/qfO0CSirMs/lNUQRdY6TRLS8mKqCwbBx3sOKMDs5UA8vWW3N
Pa20lABuEh0QUF6ViGVs2WWhiwdr7TdbW7TUqcT0R6wY80DC0aKNt5u3ENNQ8KKc
DG5tMuknrPKIaACnyQ/jsns36Mc=
=1+hu
-----END PGP SIGNATURE-----