PT-2015-2231 · Cisco · Cisco Nx-Os+1
Published
2015-06-10
·
Updated
2017-01-04
·
CVE-2015-0775
CVSS v2.0
5.0
Medium
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:P |
Name of the Vulnerable Software and Affected Versions
Cisco NX-OS versions 4.1(2)E1(1f) through 7.2(0)ZN(99.67)
Description
The issue is related to the implementation of the banner (MOTD) in Cisco NX-OS, which allows remote attackers to cause a denial of service (login process reset) via an unspecified terminal-session request during TELNET session setup. This is due to errors in resource management. An attacker could exploit this by repeatedly issuing a Telnet session to the NX-OS device, causing the login process to reset. The requirement to start a Telnet session with the targeted device may decrease the likelihood of a successful exploit, depending on the device's configuration.
Recommendations
For Cisco NX-OS version 4.1(2)E1(1f), consider disabling the Telnet service as a temporary workaround until a patch is available.
For Cisco NX-OS version 5.2(1)SV3(2.1), restrict access to the MOTD functionality to minimize the risk of exploitation.
For Cisco NX-OS version 6.0(2)N2(2), avoid using the Telnet protocol for remote access until the issue is resolved.
For Cisco NX-OS version 6.2(11), consider implementing additional security measures to prevent unauthorized access.
For Cisco NX-OS version 6.2(12), restrict the
terminal-session request to prevent the login process reset.
For Cisco NX-OS version 7.0(3), disable the MOTD display handling for Telnet sessions as a temporary mitigation measure.
For Cisco NX-OS version 7.2(0)ZN(99.67), consider applying configuration changes to prevent the exploitation of the vulnerability.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.DoS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cisco Nx-Os
Cisco Nexus