PT-2016-4801 · Cisco · Cisco Nx-Os+1

Publicado 2016-10-05 · Atualizado 2022-06-05 · CVE-2016-1453

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco NX-OS versions 5.0 through 7.3

Description A buffer overflow issue in the Overlay Transport Virtualization (OTV) GRE feature allows remote attackers to execute arbitrary code via long parameters in a packet header. The vulnerability is due to incomplete input validation performed on the size of OTV packet header parameters, which can result in a buffer overflow. An attacker could exploit this vulnerability by sending a crafted OTV UDP packet to the OTV interface on an affected device, potentially allowing the attacker to execute arbitrary code and obtain full control of the system or cause a reload of the OTV related process on the affected device.

Recommendations For Cisco NX-OS versions 5.0 through 7.3, update to a fixed software version to address this issue. As a temporary workaround, consider implementing a mitigation strategy to restrict the sending of crafted OTV UDP packets to the OTV interface on affected devices.

Correção

RCE

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2016-1453

Produtos afetados

Cisco Nx-Os

Cisco Nexus

Referências · 6

• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-otv · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-1453 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-1453 · Aviso do Fabricante
• https://t.me/cvenotify/28472 · Publicação no Telegram
• http://securityfocus.com/bid/93409 · Nota
• http://securitytracker.com/id/1036946 · Nota