PT-2013-2972 · Cisco · Cisco Nexus 1000V+1

Publicado 2013-05-29 · Atualizado 2013-05-30 · CVE-2013-1209

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Nexus 1000V (affected versions not specified)

Description The encryption functionality in the Virtual Supervisor Module (VSM) to Virtual Ethernet Module (VEM) communication component does not properly authenticate VSM/VEM packets. This allows remote attackers to disable packet-level encryption and integrity protection via crafted packets. The vulnerability is due to insufficient authentication of VSM/VEM packets. An attacker could exploit this vulnerability by sending specially crafted packets to a vulnerable VSM or VEM. To exploit this vulnerability, the attacker would likely need access to a trusted, internal network to send specially crafted packets to a targeted device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2013-1209

Produtos afetados

Cisco Nexus

Cisco Nexus 1000V

Referências · 3

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20130529-CVE-2013-1209 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-1209 · Nota de Segurança
• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1209 · Aviso do Fabricante