PT-2017-16203 · Vmware · Vmware Nsx Edge

Published 2017-12-05 · Updated 2017-12-22 · CVE-2017-4920

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions VMware NSX-V Edge versions 6.2.x prior to 6.2.8 VMware NSX-V Edge versions 6.3.x prior to 6.3.3

Description The issue arises from the incorrect handling of link-state advertisements (LSAs) in the OSPF protocol implementation. A rogue LSA can exploit this, causing continuous sending of LSAs between two routers, potentially leading to a loop or loss of connectivity.

Recommendations For versions 6.2.x prior to 6.2.8, update to version 6.2.8 or later. For versions 6.3.x prior to 6.3.3, update to version 6.3.3 or later.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2017-4920

Affected Products

Vmware Nsx Edge

References · 4

• https://vmware.com/security/advisories/VMSA-2017-0014.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-4920 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-4920 · Security Note
• http://securityfocus.com/bid/100277 · Note