PT-2018-8600 · Cisco · Cisco Nx-Os System+1

Publicado 2018-01-17 · Atualizado 2019-10-09 · CVE-2018-0090

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Cisco NX-OS System Software versions 7.3.2 and earlier

Description: A vulnerability in the management interface access control list (ACL) configuration could allow an unauthenticated, remote attacker to bypass configured ACLs on the management interface. This could allow traffic to be forwarded to the NX-OS CPU for processing, leading to high CPU utilization and a denial of service (DoS) condition. The vulnerability is due to a bad code fix that could allow traffic to the management interface to be misclassified and not match the proper configured ACLs. An attacker could exploit this vulnerability by sending crafted traffic to the management interface, potentially impacting the CPU of the targeted device and resulting in a DoS condition.

Recommendations: For Cisco NX-OS System Software version 7.3.2 and earlier, consider disabling the management interface or restricting access to it until a patch is available. As a temporary workaround, restrict traffic to the management interface to minimize the risk of exploitation. There are no workarounds that address this vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Resource Exhaustion

RCE

Enumeração de Fraquezas

CWE-400

CWE-20

Identificadores relacionados

CVE-2018-0090

Produtos afetados

Cisco Nx-Os System

Cisco Nexus

Referências · 5

• http://securityfocus.com/bid/102753 · Nota
• http://securitytracker.com/id/1040247 · Nota
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-nxos · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-0090 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-0090 · Nota de Segurança