CVE-2021-1352 — Use of Out-of-range Pointer Offset in Cisco IOS XE Software

CWE-823 — Use of Out-of-range Pointer OffsetCWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer6 documents5 sources
Severity
6.5MEDIUMNVD
CNA7.4
EPSS
0.1%
top 77.64%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco IOS XE SoftwareCisco IOS XE
Timeline
PublishedMar 24
Latest updateMay 24

Description

A vulnerability in the DECnet Phase IV and DECnet/OSI protocol processing of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient input validation of DECnet traffic that is received by an affected device. An attacker could exploit this vulnerability by sending DECnet traffic to an affected device. A successful exploit could allow the attacker to cause the affected devic…

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶NVDcisco/ios_xe89 versions+88

🔴Vulnerability Details

2
GHSA
GHSA-vcq5-wh47-842g: A vulnerability in the DECnet Phase IV and DECnet/OSI protocol processing of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker t↗2022-05-24
▶
CVEList
Cisco IOS XE Software DECnet Phase IV/OSI Denial of Service Vulnerability↗2021-03-24
▶

📋Vendor Advisories

1
Cisco
Cisco IOS XE Software DECnet Phase IV/OSI Denial of Service Vulnerability↗2021-03-24
▶

🕵️Threat Intelligence

2
Talos
Vulnerability Spotlight: Use-after-free condition in Google Chrome could lead to code execution↗2021-12-01
▶
Talos
Vulnerability Spotlight: Use-after-free condition in Google Chrome could lead to code execution↗2021-12-01
▶
CVE-2021-1352 — Use of Out-of-range Pointer Offset | cvebase