PT-2016-4813 · Vmware+1 · Esxi+2

Publicado 2016-07-27 · Atualizado 2017-09-01 · CVE-2016-1465

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco Nexus 1000v Application Virtual Switch (AVS) versions prior to 5.2(1)SV3(1.5i)

Description A denial of service issue exists due to insufficient input validation of Cisco Discovery Protocol packets, which could result in an out-of-bounds memory access and cause the ESXi hypervisor to crash, displaying a purple diagnostic screen. An attacker could exploit this by sending a crafted Cisco Discovery Protocol packet to a targeted device, resulting in a denial of service condition.

Recommendations For versions prior to 5.2(1)SV3(1.5i), update to version 5.2(1)SV3(1.5i) or later to resolve the issue. As a temporary workaround, consider restricting access to the Cisco Discovery Protocol to minimize the risk of exploitation.

Correção

DoS

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2016-1465

Produtos afetados

Cisco Nexus

Cisco Nexus 1000V Application Virtual Switch

Esxi

Referências · 5

• http://securityfocus.com/bid/92154 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-1465 · Nota de Segurança
• http://securitytracker.com/id/1036469 · Nota
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160727-avs · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-1465 · Aviso do Fabricante