PT-2013-2975 · Cisco+1 · Nx-Os+3

Published 2013-05-29 · Updated 2013-06-11 · CVE-2013-1212

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Nexus 1000V (affected versions not specified)

Description The SSL functionality in Cisco NX-OS does not properly verify X.509 certificates, allowing man-in-the-middle attackers to spoof servers and intercept or modify Virtual Supervisor Module (VSM) to VMware vCenter communication via a crafted certificate. This vulnerability enables attackers to eavesdrop on communications and inject modified or arbitrary data. The issue is due to improper verification of SSL security certificates by the VSM. To exploit this, an attacker would likely need access to a trusted internal network and the communication path between the VSM and vCenter server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2013-1212

Affected Products

Cisco Nexus

Cisco Nexus 1000V

Nx-Os

Vmware Vcenter

References · 3

• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1212 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-1212 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20130529-CVE-2013-1212 · Note