Summary

• Cisco released its semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication on March 22, 2017. In direct response to customer feedback, Cisco releases bundles of Cisco IOS Software Security Advisories on the fourth Wednesday of the month in March and September of each calendar year.

  The March 22, 2017, release of the Cisco IOS and IOS XE Software Security Advisory Bundled Publication includes five Cisco Security Advisories that describe five vulnerabilities in Cisco IOS Software and Cisco IOS XE Software. Two of the advisories describe vulnerabilities that are common to both Cisco IOS Software and Cisco IOS XE Software. Three of the advisories describe vulnerabilities that exist only in Cisco IOS XE Software. All the vulnerabilities have a Security Impact Rating of High. Successful exploitation of the vulnerabilities could cause a denial of service (DoS) condition or allow an attacker to execute arbitrary code on an affected system.

  Cisco has confirmed that none of the vulnerabilities exist in Cisco IOS XR Software or Cisco NX-OS Software.

  To quickly determine if a specific Cisco IOS or IOS XE Software release is exposed to Cisco product vulnerabilities, use the Cisco IOS Software Checker.

Details

• The following table identifies Cisco Security content that is associated with this Cisco IOS and IOS XE Software Security Advisory Bundled Publication:

  Cisco Security Advisory	CVE ID	Security Impact Rating	CVSS Base Score	IPS Signature	OVAL Definition
  cisco-sa-20170322-dhcpc Cisco IOS and IOS XE Software DHCP Client Denial of Service Vulnerability	CVE-2017-3864	High	8.6	–	cisco-sa-20170322-dhcpc-CVE-2017-3864
  cisco-sa-20170322-l2tp Cisco IOS and IOS XE Software Layer 2 Tunneling Protocol Denial of Service Vulnerability	CVE-2017-3857	High	8.6	Cisco IOS and IOS XE Software Layer 2 Tunneling Protocol Denial of Service	cisco-sa-20170322-l2tp-CVE-2017-3857
  cisco-sa-20170322-ztp Cisco IOS XE Software for Cisco ASR 920 Series Routers Zero Touch Provisioning Denial of Service Vulnerability	CVE-2017-3859	High	8.6	Cisco IOS XE Software Denial of Service	–
  cisco-sa-20170322-xeci Cisco IOS XE Software HTTP Command Injection Vulnerability	CVE-2017-3858	High	8.8	Cisco IOS XE Software HTTP Command Injection	–
  cisco-sa-20170322-webui Cisco IOS XE Software Web User Interface Denial of Service Vulnerability	CVE-2017-3856	High	8.6	Cisco IOS XE Software Web User Interface Denial of Service	–

  
  

  Related Resources

  Cisco Security Vulnerability Policy
  MITRE Common Vulnerabilities and Exposures
  Common Vulnerability Scoring System and the Security Impact Rating
  Common Vulnerability Scoring System Q & A
  Cisco IPS Signature Downloads
  Cisco IOS OVAL Content: Frequently Asked Questions