PT-2016-3562 · Cisco · Cisco Nx-Os+1

Publicado 2016-10-05 · Atualizado 2017-07-30 · CVE-2015-0721

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco NX-OS versions 4.0 through 7.3

Description The issue allows remote authenticated users to bypass intended AAA restrictions and obtain privileged CLI access via crafted parameters in an SSH connection negotiation. This is due to the improper processing of certain parameters passed to an affected device during the negotiation of an SSH connection. An attacker could exploit this by authenticating to an affected device and passing a malicious value as part of the login procedure, potentially allowing them to execute commands on the device command-line interface (CLI) that should be restricted to a different privileged user role.

Recommendations For Cisco NX-OS versions 4.0 through 7.3, update to a version that includes the software updates released by Cisco to address this issue.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2015-0721

Produtos afetados

Cisco Nx-Os

Cisco Nexus

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2015-0721 · Nota de Segurança
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-nxaaa · Aviso do Fabricante
• http://securityfocus.com/bid/93410 · Nota
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-nxaaa · Aviso do Fabricante
• http://securitytracker.com/id/1036947 · Nota