CVE-2017-12319

published 2018-03-27

CVE-2017-12319: A vulnerability in the Border Gateway Protocol (BGP) over an Ethernet Virtual Private Network (EVPN) for Cisco IOS XE Software could allow an unauthenticated…

Priority P2 77 medium 5.9 CVSS 3.1

AV N AC H PR N UI N S U C N I N A H

KEV ITW

A vulnerability in the Border Gateway Protocol (BGP) over an Ethernet Virtual Private Network (EVPN) for Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload, resulting in a denial of service (DoS) condition, or potentially corrupt the BGP routing table, which could result in network instability. The vulnerability exists due to changes in the implementation of the BGP MPLS-Based Ethernet VPN RFC (RFC 7432) draft between IOS XE software releases. When the BGP Inclusive Multicast Ethernet Tag Route or BGP EVPN MAC/IP Advertisement Route update packet is received, it could be possible that the IP address length field is miscalculated. An attacker could exploit this vulnerability by sending a crafted BGP packet to an affected device after the BGP session was established. An exploit could allow the attacker to cause the affected device to reload or corrupt the BGP routing table; either outcome would result in a DoS. The vulnerability may be triggered when the router receives a crafted BGP message from a peer on an existing BGP session. This vulnerability affects all releases of Cisco IOS XE Software prior to software release 16.3 that support BGP EVPN configurations. If the device is not configured for EVPN, it is not vulnerable. Cisco Bug IDs: CSCui67191, CSCvg52875.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
cisco	ios	—	—
cisco	ios_xe	< 16.3	16.3
cisco	ios_xe	—	—

Detection & IOCs extracted from sources · hover to see the quote

• → Trigger condition: crafted BGP Inclusive Multicast Ethernet Tag Route or BGP EVPN MAC/IP Advertisement Route UPDATE packet with miscalculated IP address length field sent over an established BGP session ↗
• → Attack requires an established BGP TCP session (port 179); attacker must spoof or hijack a trusted BGP peer TCP connection, or inject malformed messages into the victim's BGP network ↗
• → Vulnerability is only present on devices with BGP EVPN configured; devices without EVPN configuration are not vulnerable — use this as a scoping filter ↗
• → At least one BGP neighbor session must be established for a router to be vulnerable; monitor for unexpected BGP session establishments with unknown peers ↗
• → Affected scope: all releases of Cisco IOS XE Software prior to release 16.3 supporting BGP EVPN configurations ↗

• · Cisco BGP only accepts traffic from explicitly defined peers; exploitation requires knowledge of trusted BGP peer relationships in the target network ↗
• · There are no workarounds available; patching to IOS XE 16.3 or later is the only mitigation ↗
• · Vulnerability stems from RFC 7432 (BGP MPLS-Based Ethernet VPN) draft implementation differences between IOS XE releases, meaning the bug is in the parsing of a standards-defined message type ↗

CVSS provenance

nvd v3.1 5.9 MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

nvd v2.0 7.1 HIGH AV:N/AC:M/Au:N/C:N/I:N/A:C

vulncheck 5.9 MEDIUM

cisa 5.9 MEDIUM

vendor_cisco 6.8 MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-20