PT-2018-8739 · Cisco · Cisco Nx-Os+2

Published 2018-06-20 · Updated 2019-10-09 · CVE-2018-0304

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Cisco FXOS Software and Cisco NX-OS Software (affected versions not specified)

Description: A vulnerability in the Cisco Fabric Services component could allow an unauthenticated, remote attacker to read sensitive memory content, create a denial of service (DoS) condition, or execute arbitrary code as root. The vulnerability exists because the affected software insufficiently validates Cisco Fabric Services packet headers. An attacker could exploit this vulnerability by sending a crafted Cisco Fabric Services packet to an affected device. A successful exploit could allow the attacker to cause a buffer overflow or buffer overread condition in the Cisco Fabric Services component.

Recommendations: For Cisco FXOS Software and Cisco NX-OS Software, update to a version that includes the fix for this vulnerability, as software updates have been released by Cisco to address this issue. At the moment, there is no information about specific versions that contain a fix for this vulnerability.

Fix

DoS

RCE

Out of bounds Read

Weakness Enumeration

CWE-20

CWE-125

Related Identifiers

CVE-2018-0304

Affected Products

Cisco Fxos

Cisco Nx-Os

Cisco Nexus

References · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-fxnxos-ace · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-0304 · Security Note
• https://osv.dev/vulnerability/CVE-2018-0304 · Vendor Advisory
• http://securityfocus.com/bid/104513 · Note
• http://securitytracker.com/id/1041169 · Note