PT-2013-2975 · Cisco+1 · Nx-Os+3

Publicado 2013-05-29 · Atualizado 2013-06-11 · CVE-2013-1212

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Nexus 1000V (affected versions not specified)

Description The SSL functionality in Cisco NX-OS does not properly verify X.509 certificates, allowing man-in-the-middle attackers to spoof servers and intercept or modify Virtual Supervisor Module (VSM) to VMware vCenter communication via a crafted certificate. This vulnerability enables attackers to eavesdrop on communications and inject modified or arbitrary data. The issue is due to improper verification of SSL security certificates by the VSM. To exploit this, an attacker would likely need access to a trusted internal network and the communication path between the VSM and vCenter server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2013-1212

Produtos afetados

Cisco Nexus

Cisco Nexus 1000V

Nx-Os

Vmware Vcenter

Referências · 3

• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1212 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-1212 · Nota de Segurança
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20130529-CVE-2013-1212 · Nota