PT-2019-3282 · Cisco · Cisco Nx-Os+1

Publicado 2019-08-28 · Atualizado 2020-10-16 · CVE-2019-1967

Positive Technologies (AI Summary)

CVSS v3.1

8.6

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco NX-OS Software (affected versions not specified)

Description A vulnerability in the Network Time Protocol (NTP) feature could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The issue is due to excessive use of system resources when the device is logging a drop action for received MODE PRIVATE (Mode 7) NTP packets. An attacker could exploit this by flooding the device with a steady stream of Mode 7 NTP packets, potentially causing high CPU and memory usage, which could lead to internal system processes restarting or the device unexpectedly reloading. The NTP feature is enabled by default.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

CWE-399

Identificadores relacionados

BDU:2019-03305

CVE-2019-1967

Produtos afetados

Cisco Nx-Os

Cisco Nexus

Referências · 4

• https://bdu.fstec.ru/vul/2019-03305 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2019-1967 · Nota de Segurança
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190828-nxos-ntp-dos · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-1967 · Aviso do Fabricante