PT-2018-8739 · Cisco · Cisco Nx-Os+2

Publicado 2018-06-20 · Atualizado 2019-10-09 · CVE-2018-0304

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Cisco FXOS Software and Cisco NX-OS Software (affected versions not specified)

Description: A vulnerability in the Cisco Fabric Services component could allow an unauthenticated, remote attacker to read sensitive memory content, create a denial of service (DoS) condition, or execute arbitrary code as root. The vulnerability exists because the affected software insufficiently validates Cisco Fabric Services packet headers. An attacker could exploit this vulnerability by sending a crafted Cisco Fabric Services packet to an affected device. A successful exploit could allow the attacker to cause a buffer overflow or buffer overread condition in the Cisco Fabric Services component.

Recommendations: For Cisco FXOS Software and Cisco NX-OS Software, update to a version that includes the fix for this vulnerability, as software updates have been released by Cisco to address this issue. At the moment, there is no information about specific versions that contain a fix for this vulnerability.

Correção

DoS

RCE

Out of bounds Read

Enumeração de Fraquezas

CWE-20

CWE-125

Identificadores relacionados

CVE-2018-0304

Produtos afetados

Cisco Fxos

Cisco Nx-Os

Cisco Nexus

Referências · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-fxnxos-ace · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-0304 · Nota de Segurança
• http://securityfocus.com/bid/104513 · Nota
• http://securitytracker.com/id/1041169 · Nota
• https://osv.dev/vulnerability/CVE-2018-0304 · Aviso do Fabricante