PT-2013-2972 · Cisco · Cisco Nexus 1000V+1

Published 2013-05-29 · Updated 2013-05-30 · CVE-2013-1209

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Nexus 1000V (affected versions not specified)

Description The encryption functionality in the Virtual Supervisor Module (VSM) to Virtual Ethernet Module (VEM) communication component does not properly authenticate VSM/VEM packets. This allows remote attackers to disable packet-level encryption and integrity protection via crafted packets. The vulnerability is due to insufficient authentication of VSM/VEM packets. An attacker could exploit this vulnerability by sending specially crafted packets to a vulnerable VSM or VEM. To exploit this vulnerability, the attacker would likely need access to a trusted, internal network to send specially crafted packets to a targeted device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2013-1209

Affected Products

Cisco Nexus

Cisco Nexus 1000V

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2013-1209 · Security Note
• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1209 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20130529-CVE-2013-1209 · Note