A vulnerability in the implementation of the Short Message Service (SMS) handling functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a denial of service (DoS) condition on an affected device. The vulnerability is due to improper processing of SMS protocol data units (PDUs) that are encoded with a special character set. An attacker could exploit this vulnerability by sending a malicious SMS message to an affected device. A successful exploit could allow the attacker to cause the wireless WAN (WWAN) cellular interface module on an affected device to crash, resulting in a DoS condition that would require manual intervention to restore normal operating conditions.

According to the versions of the PyYAML package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability in the implementation of the Short     Message Service (SMS) handling functionality of Cisco     IOS Software and Cisco IOS XE Software could allow an     unauthenticated, remote attacker to trigger a denial of     service (DoS) condition on an affected device. The     vulnerability is due to improper processing of SMS     protocol data units (PDUs) that are encoded with a     special character set. An attacker could exploit this     vulnerability by sending a malicious SMS message to an     affected device. A successful exploit could allow the     attacker to cause the wireless WAN (WWAN) cellular     interface module on an affected device to crash,     resulting in a DoS condition that would require manual     intervention to restore normal operating conditions.
    (CVE-2019-1747)

  - PyYAML 5.1 through 5.1.2 has insufficient restrictions     on the load and load_all functions because of a class     deserialization issue, e.g., Popen is a class in the     subprocess module. NOTE: this issue exists because of     an incomplete fix for CVE-2017-18342. (CVE-2019-20477)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the PyYAML package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability in the implementation of the Short     Message Service (SMS) handling functionality of Cisco     IOS Software and Cisco IOS XE Software could allow an     unauthenticated, remote attacker to trigger a denial of     service (DoS) condition on an affected device. The     vulnerability is due to improper processing of SMS     protocol data units (PDUs) that are encoded with a     special character set. An attacker could exploit this     vulnerability by sending a malicious SMS message to an     affected device. A successful exploit could allow the     attacker to cause the wireless WAN (WWAN) cellular     interface module on an affected device to crash,     resulting in a DoS condition that would require manual     intervention to restore normal operating     conditions.(CVE-2019-1747)

  - PyYAML 5.1 through 5.1.2 has insufficient restrictions     on the load and load_all functions because of a class     deserialization issue, e.g., Popen is a class in the     subprocess module. NOTE: this issue exists because of     an incomplete fix for CVE-2017-18342.(CVE-2019-20477)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version, the installed Cisco IOS XE Software is affected by a vulnerability in its implementation of the Short Message Service (SMS) handling functionality. This allows an unauthenticated, remote attacker to trigger a denial of service (DoS) condition on an affected device. The vulnerability is due to improper processing of SMS protocol data units (PDUs) that are encoded with a special character set. An attacker can exploit this vulnerability by sending a malicious SMS message to an affected device. A successful exploit allows the attacker to cause the wireless WAN (WWAN) cellular interface module on an affected device to crash, resulting in a DoS condition that would require manual intervention to restore normal operating conditions.

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version, the installed Cisco IOS Software is affected by a vulnerability in its implementation of the Short Message Service (SMS) handling functionality. This allows an unauthenticated, remote attacker to trigger a denial of service (DoS) condition on an affected device. The vulnerability is due to improper processing of SMS protocol data units (PDUs) that are encoded with a special character set. An attacker can exploit this vulnerability by sending a malicious SMS message to an affected device. A successful exploit allows the attacker to cause the wireless WAN (WWAN) cellular interface module on an affected device to crash, resulting in a DoS condition that would require manual intervention to restore normal operating conditions.

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
151393	EulerOS Virtualization 3.0.2.2 : PyYAML (EulerOS-SA-2021-2165)	Nessus	Huawei Local Security Checks	critical
142568	EulerOS Virtualization 3.0.6.6 : PyYAML (EulerOS-SA-2020-2475)	Nessus	Huawei Local Security Checks	critical
128114	Cisco IOS XE Software Short Message Service Denial of Service Vulnerability	Nessus	CISCO	high
128113	Cisco IOS Short Message Service Denial of Service Vulnerability	Nessus	CISCO	high

Detections

Analytics

CVE-2019-1747

high

Tenable Plugins

critical

critical

high

high