# MA-697.032018: MyCERT Advisory - Cisco Releases Security Updates

**Date:** 02 Apr 2018  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-697.032018  
**Advisory ID:** MA-697.032018

---

**1.0 Introduction**
Cisco has released updates to address vulnerabilities affecting multiple products.
**2.0 Impact**
A remote attacker could exploit some of these vulnerabilities to obtain sensitive information.
**3.0 Affected Products**
• Cisco IOS XE
• Cisco IOS
• Cisco IOS XR
**4.0 Recommendations**
Users and administrators are encouraged to review the below links for more information and do necessary updates:
• Cisco IOS XE Software Static Credential Vulnerability:
<https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-xesc>
• Cisco IOS and IOS XE Software Smart Install Remote Code Execution Vulnerability:
<https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2>
• Cisco IOS and IOS XE Software Quality of Service Remote Code Execution Vulnerability:
<https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-qos>
• Cisco IOS XE Software Web UI Remote Access Privilege Escalation Vulnerability cisco-sa-20180328-xepriv
<http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-xepriv>
• Cisco IOS XE Software Simple Network Management Protocol Double-Free Denial of Service Vulnerability:
<https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-snmp-dos>
• Cisco IOS Software Simple Network Management Protocol GET MIB Object ID Denial of Service Vulnerability
<https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-snmp>
• Cisco IOS and IOS XE Software Smart Install Denial of Service Vulnerability
<https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi>
• Cisco IOS XE Software User EXEC Mode Root Shell Access Vulnerabilities
<https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-privesc1>
• Cisco IOS XE Software with Cisco Umbrella Integration Denial of Service Vulnerability
<https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-opendns-dos>
• Cisco IOS, IOS XE, and IOS XR Software Link Layer Discovery Protocol Buffer Overflow Vulnerabilities
<https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-lldp>
• Cisco IOS XE Software for Cisco Catalyst Switches IPv4 Denial of Service Vulnerability
<https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-ipv4>
• Cisco IOS and IOS XE Software Internet Key Exchange Version 1 Denial of Service Vulnerability
<https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-ike-dos>
• Cisco IOS and IOS XE Software Internet Key Exchange Memory Leak Vulnerability
<https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-ike>
• Cisco IOS XE Software Internet Group Management Protocol Memory Leak Vulnerability
<https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-igmp>
• Cisco IOS XE Software Zone-Based Firewall IP Fragmentation Denial of Service Vulnerability
<https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-fwip>
• Cisco IOS Software Integrated Services Module for VPN Denial of Service Vulnerability
<https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-dos>
• Cisco IOS and IOS XE Software DHCP Version 4 Relay Denial of Service Vulnerability
<https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-dhcpr3>
• Cisco IOS and IOS XE Software DHCP Version 4 Relay Reply Denial of Service Vulnerability
<https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-dhcpr2>
• Cisco IOS and IOS XE Software DHCP Version 4 Relay Heap Overflow Denial of Service Vulnerability
<https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-dhcpr1>
• Cisco IOS and IOS XE Software Bidirectional Forwarding Detection Denial of Service Vulnerability
<https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-bfd>
MyCERT advises the users of this software to be updated with the latest security announcements by the vendor, apply necessary updates and follow best practice security policies.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection#f19288939483c8c8c8b192889394838294928483988588df9c88) or [[email protected]](/cdn-cgi/l/email-protection#660b1f05031412260b1f0503141248091401480b1f)
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 89453442
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 AM - 18:00 PM MYT
Web: <https://www.mycert.org.my>
Twitter: <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0 References**
• <https://www.us-cert.gov/ncas/current-activity/2018/03/28/Cisco-Releases-Security-Updates>