PT-2017-17220 · Cisco · Cisco Nx-Os+1

Publicado 2017-06-07 · Atualizado 2021-12-16 · CVE-2017-6655

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco NX-OS Software versions 8.3(0)CV(0.833)

Description A vulnerability in the Fibre Channel over Ethernet (FCoE) protocol implementation could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition when an FCoE-related process unexpectedly reloads. The vulnerability is due to a lack of proper FCoE frame padding validation. An attacker could exploit this vulnerability by sending a stream of crafted FCoE frames to the targeted device, which must be directly connected to the FCoE interface on the device that is running Cisco NX-OS Software.

Recommendations For Cisco NX-OS Software version 8.3(0)CV(0.833), update to version 8.3(0)ISH(0.62), 8.3(0)CV(0.944), 8.1(1), 8.1(0.8)S0, or 7.3(2)D1(0.47) to resolve the issue. As a temporary workaround, consider restricting access to the FCoE interface to minimize the risk of exploitation.

Correção

DoS

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2017-6655

Produtos afetados

Cisco Nx-Os

Cisco Nexus

Referências · 5

• https://osv.dev/vulnerability/CVE-2017-6655 · Aviso do Fabricante
• http://securitytracker.com/id/1038628 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-6655 · Nota de Segurança
• http://securityfocus.com/bid/98991 · Nota
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170607-nxos · Aviso do Fabricante