PT-2013-2971 · Cisco · Cisco Nexus 1000V+1

Published 2013-05-29 · Updated 2013-05-30 · CVE-2013-1208

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Nexus 1000V (affected versions not specified)

Description The encryption functionality in Cisco NX-OS does not properly handle Virtual Supervisor Module (VSM) to Virtual Ethernet Module (VEM) communication. This allows remote attackers to intercept or modify network traffic by leveraging certain Layer 2 or Layer 3 access. The issue is due to errors in the implementation of the cryptography employed for VSM to VEM communications. An attacker must have access to the Layer 2 management VLAN or the Layer 3 management traffic to exploit this issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2013-1208

Affected Products

Cisco Nexus

Cisco Nexus 1000V

References · 3

• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1208 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-1208 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20130529-CVE-2013-1208 · Note