PT-2017-1536 · Cisco · Cisco Nx-Os+1

Published 2017-03-15 · Updated 2017-07-12 · CVE-2017-3879

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Cisco NX-OS Software versions 7.0(3)I3(1) through 8.3(0)CV(0.345)

Description A Denial of Service issue in the remote login functionality for Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a process used for login to terminate unexpectedly and the login attempt to fail. The attacker could use either a Telnet or an SSH client for the remote login attempt. There is no impact to user traffic flowing through the device. The issue is due to improper handling of failed authentication during login.

Recommendations For versions 7.0(3)I3(1) and 8.3(0)CV(0.342), update to version 8.3(0)CV(0.362) or later. For version 8.3(0)CV(0.345), update to version 8.3(0)CV(0.362) or later. As a temporary workaround, consider restricting access to remote Telnet connections to minimize the risk of exploitation.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2017-00681

CVE-2017-3879

Affected Products

Cisco Nx-Os

Cisco Nexus

References · 6

• https://osv.dev/vulnerability/CVE-2017-3879 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-00681 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-nss1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-3879 · Security Note
• http://securityfocus.com/bid/96920 · Note
• http://securitytracker.com/id/1038046 · Note