PT-2016-4813 · Vmware+1 · Esxi+2

Published 2016-07-27 · Updated 2017-09-01 · CVE-2016-1465

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco Nexus 1000v Application Virtual Switch (AVS) versions prior to 5.2(1)SV3(1.5i)

Description A denial of service issue exists due to insufficient input validation of Cisco Discovery Protocol packets, which could result in an out-of-bounds memory access and cause the ESXi hypervisor to crash, displaying a purple diagnostic screen. An attacker could exploit this by sending a crafted Cisco Discovery Protocol packet to a targeted device, resulting in a denial of service condition.

Recommendations For versions prior to 5.2(1)SV3(1.5i), update to version 5.2(1)SV3(1.5i) or later to resolve the issue. As a temporary workaround, consider restricting access to the Cisco Discovery Protocol to minimize the risk of exploitation.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2016-1465

Affected Products

Cisco Nexus

Cisco Nexus 1000V Application Virtual Switch

Esxi

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2016-1465 · Security Note
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160727-avs · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-1465 · Vendor Advisory
• http://securityfocus.com/bid/92154 · Note
• http://securitytracker.com/id/1036469 · Note