PT-2018-8611 · Cisco · Cisco Nx-Os+1
Publicado
2018-01-17
·
Atualizado
2019-10-09
·
CVE-2018-0102
CVSS v3.1
7.4
Alta
| Vetor | AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions:
Cisco NX-OS Software versions 7.2(1)D(1) through 7.2(2)D1(2)
Description:
A vulnerability in the Pong tool of Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability exists because the affected software attempts to free the same area of memory twice. An attacker could exploit this vulnerability by sending a pong request to an affected device from a location on the network that causes the pong reply packet to egress both a FabricPath port and a non-FabricPath port. This could allow the attacker to cause a dual or quad supervisor virtual port-channel (vPC) to reload. The vulnerability is exploitable only when the Pong tool, FabricPath feature, and a SPAN session monitoring a FabricPath port are all enabled.
Recommendations:
For Cisco NX-OS Software versions 7.2(1)D(1) through 7.2(2)D1(2), update to a newer version that includes the fix for this vulnerability.
As a temporary workaround, consider disabling the Pong tool until a patch is available.
Restrict access to the FabricPath feature to minimize the risk of exploitation.
Avoid configuring a SPAN session to monitor a FabricPath port until the issue is resolved.
Correção
DoS
Double Free
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Cisco Nx-Os
Cisco Nexus