PT-2017-1537 · Cisco · Cisco Nx-Os

Published 2017-03-17 · Updated 2017-07-12 · CVE-2017-3878

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Cisco NX-OS Software versions prior to 7.0(3)I3(1) Cisco NX-OS Software versions prior to 7.0(3)I3(0.257) Cisco NX-OS Software versions prior to 7.0(3)I3(0.255) Cisco NX-OS Software versions prior to 7.0(3)I2(2e) Cisco NX-OS Software versions prior to 7.0(3)F1(1.22) Cisco NX-OS Software versions prior to 7.0(3)F1(1)

Description A Denial of Service issue in the Telnet remote login functionality of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a Telnet process used for login to terminate unexpectedly and the login attempt to fail. The vulnerability is caused by a buffer overflow in memory. There is no impact to user traffic flowing through the device.

Recommendations For versions 7.0(3)I3(0.170) and earlier, update to version 7.0(3)I3(1) or later. For versions prior to 7.0(3)I3(0.257), update to version 7.0(3)I3(0.257) or later. For versions prior to 7.0(3)I3(0.255), update to version 7.0(3)I3(0.255) or later. For versions prior to 7.0(3)I2(2e), update to version 7.0(3)I2(2e) or later. For versions prior to 7.0(3)F1(1.22), update to version 7.0(3)F1(1.22) or later. For versions prior to 7.0(3)F1(1), update to version 7.0(3)F1(1) or later.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2017-00682

CVE-2017-3878

Affected Products

Cisco Nx-Os

References · 6

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-nss · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-3878 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-3878 · Security Note
• https://bdu.fstec.ru/vul/2017-00682 · Security Note
• http://securityfocus.com/bid/96927 · Note
• http://securitytracker.com/id/1038047 · Note