PT-2017-3328 · Cisco · Cisco Nx-Os System+4

Published 2017-11-29 · Updated 2019-10-09 · CVE-2017-12341

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco NX-OS System Software versions prior to the fixed version

Description The issue is due to insufficient input validation during the installation of a software patch, allowing an authenticated, local attacker to perform a command injection attack. An attacker would need valid administrator credentials to exploit this. By installing a crafted patch image, an attacker could execute arbitrary commands on an affected system as root. This affects various Cisco products running Cisco NX-OS System Software, including Multilayer Director Switches, Nexus 2000 Series Fabric Extenders, Nexus 5000 Series Switches, and others.

Recommendations For Cisco NX-OS System Software, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the CLI to minimize the risk of exploitation. Avoid installing crafted patch images until the issue is resolved. There are no other workarounds that address this issue.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2018-00093

CVE-2017-12341

Affected Products

Cisco Nx-Os System

Cisco Nexus

Multilayer Director Switches

Nexus 2000 Series Fabric Extenders

Nexus 5000 Series Switches

References · 5

• https://osv.dev/vulnerability/CVE-2017-12341 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-12341 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171129-nxos8 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-00093 · Security Note
• http://securitytracker.com/id/1039939 · Note