PT-2016-1475 · Cisco · Nexus 9000 Aci Mode Switches+1

Published 2016-02-07 · Updated 2016-12-06 · CVE-2016-1302

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Application Policy Infrastructure Controller (APIC) versions prior to 1.0(3h) and prior to 1.1(1j) Nexus 9000 ACI Mode switches versions prior to 11.0(3h) and prior to 11.1(1j)

Description The issue is related to inadequate access control in the network operating system and the Application Policy Infrastructure Controller, allowing remote authenticated users to bypass intended Role-Based Access Control (RBAC) restrictions via crafted REST requests.

Recommendations For Cisco Application Policy Infrastructure Controller (APIC) versions prior to 1.0(3h), update to version 1.0(3h) or later. For Cisco Application Policy Infrastructure Controller (APIC) versions prior to 1.1(1j), update to version 1.1(1j) or later. For Nexus 9000 ACI Mode switches versions prior to 11.0(3h), update to version 11.0(3h) or later. For Nexus 9000 ACI Mode switches versions prior to 11.1(1j), update to version 11.1(1j) or later. As a temporary workaround, consider restricting access to REST endpoints to minimize the risk of exploitation.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2016-00776

CVE-2016-1302

Affected Products

Cisco Application Policy Infrastructure Controller

Nexus 9000 Aci Mode Switches

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2016-1302 · Security Note
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160203-apic · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-1302 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-00776 · Security Note
• http://securitytracker.com/id/1034925 · Note