PT-2016-1516 · Cisco · Cisco Nx-Os+1

Publicado 2016-03-02 · Atualizado 2016-12-03 · CVE-2015-0718

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco NX-OS versions 4.0 through 6.1

Description The issue is related to errors in resource management, allowing a remote attacker to cause a denial of service (TCP stack reload) by sending crafted TCP packets to a device that has a TIME WAIT TCP session. This can be exploited using either IPv4 or IPv6 packets, and the vulnerability can be triggered by a crafted sequence of TCP packets destined for TCP ports listening on the device.

Recommendations For Cisco NX-OS versions 4.0 through 6.1, update to a newer version that includes the fix for this issue, as Cisco has released software updates that address this vulnerability. At the moment, there is no information about other workarounds that address this vulnerability.

Correção

DoS

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

BDU:2016-00817

CVE-2015-0718

Produtos afetados

Cisco Nx-Os

Cisco Nexus

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2015-0718 · Nota de Segurança
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160302-netstack · Aviso do Fabricante
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160302-netstack · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2016-00817 · Nota de Segurança
• http://securitytracker.com/id/1035160 · Nota
• http://securitytracker.com/id/1035159 · Nota