PT-2020-3781 · Cisco · Cisco Nx-Os+1

Published 2020-08-26 · Updated 2021-08-06 · CVE-2020-3338

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: Cisco NX-OS (affected versions not specified)

Description: The issue is related to improper error handling when processing inbound PIM6 packets, which could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. An attacker could exploit this by sending multiple crafted PIM6 packets to an affected device, potentially causing the PIM6 application to leak system memory. Over time, this memory leak could cause the PIM6 application to stop processing legitimate PIM6 traffic, leading to a DoS condition.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Improper Resource Release

Improper Handling of Exceptional Conditions

Resource Exhaustion

Weakness Enumeration

CWE-404

CWE-755

CWE-400

Related Identifiers

BDU:2020-04143

CVE-2020-3338

Affected Products

Cisco Nx-Os

Cisco Nexus

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-3338 · Security Note
• https://bdu.fstec.ru/vul/2020-04143 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-pim-memleak-dos-tC8eP7uw · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-pim-memleak-dos-tC8eP7uw · Vendor Advisory