PT-2014-3779 · Cisco · Cisco Nx-Os+1

Publicado 2014-05-06 · Atualizado 2014-05-07 · CVE-2014-0684

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco NX-OS version 6.2(2)

Description A denial of service condition can be caused by an authenticated, local attacker on affected devices due to an error in input validation for the sed command. The attacker could exploit this by passing crafted input to the sed command, allowing them to cause a denial of service condition. This vulnerability requires local access to the targeted device, reducing the likelihood of a successful exploit.

Recommendations For Cisco NX-OS version 6.2(2), update to a newer version that includes the fix for this issue, as confirmed by Cisco in their security notice. As a temporary workaround, consider restricting access to the sed command to minimize the risk of exploitation.

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2014-0684

Produtos afetados

Cisco Nx-Os

Cisco Nexus

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2014-0684 · Nota de Segurança
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20140506-CVE-2014-0684 · Nota
• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0684 · Aviso do Fabricante
• http://tools.cisco.com/security/center/viewAlert.x?alertId=34131 · Aviso do Fabricante