PT-2019-3272 · Cisco · Cisco Nexus 9000 Series Switches

Published 2019-08-28 · Updated 2019-10-09 · CVE-2019-1977

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco Nexus 9000 Series Switches (affected versions not specified)

Description The issue is related to errors in state management within the Endpoint Learning feature of the Cisco Nexus 9000 Series Switches. This could allow a remote attacker to cause a denial of service condition on an endpoint device under certain circumstances. The problem arises when packets are received on a specific port from outside the ACI fabric and are destined for an endpoint on a border leaf, with Disable Remote Endpoint Learning enabled. This can lead to the creation of a stale Remote (XR) entry for the impacted endpoint if it migrates to a different port or leaf switch, resulting in traffic not reaching the endpoint until the entry is relearned.

Recommendations For Cisco Nexus 9000 Series Switches, consider disabling the Endpoint Learning feature as a temporary workaround until a patch is available. Restrict access to the specific port on the border leaf to minimize the risk of exploitation. Avoid using the Disable Remote Endpoint Learning option in configurations where endpoint migration is expected, until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-371

Related Identifiers

BDU:2019-03294

CVE-2019-1977

Affected Products

Cisco Nexus 9000 Series Switches

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-1977 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190828-nexus-aci-dos · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-1977 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-03294 · Security Note