PT-2014-5223 · Cisco · Cisco Nx-Os+1

Published 2014-08-06 · Updated 2017-08-29 · CVE-2014-3330

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco NX-OS version 6.1(2)I2(1)

Description The issue is related to the improper processing of packet-drop policy checks for logged packets, allowing remote attackers to bypass intended access restrictions. This can be achieved by sending a flood of packets that match a policy containing the log keyword. The vulnerability is due to insufficient policy checks for logged packets, which could allow an unauthenticated, remote attacker to bypass access list restrictions for logged traffic. An exploit could allow the attacker to bypass the access control list for a small percentage of packets that would otherwise have been dropped.

Recommendations For Cisco NX-OS version 6.1(2)I2(1), update to a newer version that includes the necessary software updates to fix the vulnerability. As a temporary workaround, consider restricting access to the logging feature to minimize the risk of exploitation. Avoid using the log keyword in access list entries until the issue is resolved.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-3330

Affected Products

Cisco Nx-Os

Cisco Nexus

References · 7

• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3330 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-3330 · Security Note
• http://tools.cisco.com/security/center/viewAlert.x?alertId=35181 · Vendor Advisory
• http://securityfocus.com/bid/69057 · Note
• http://securitytracker.com/id/1030676 · Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20140806-CVE-2014-3330 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95122 · Note