var-201801-1041
Vulnerability from variot
A vulnerability in management interface access control list (ACL) configuration of Cisco NX-OS System Software could allow an unauthenticated, remote attacker to bypass configured ACLs on the management interface. This could allow traffic to be forwarded to the NX-OS CPU for processing, leading to high CPU utilization and a denial of service (DoS) condition. The vulnerability is due to a bad code fix in the 7.3.2 code train that could allow traffic to the management interface to be misclassified and not match the proper configured ACLs. An attacker could exploit this vulnerability by sending crafted traffic to the management interface. An exploit could allow the attacker to bypass the configured management interface ACLs and impact the CPU of the targeted device, resulting in a DoS condition. This vulnerability affects the following Cisco products running Cisco NX-OS System Software: Multilayer Director Switches, Nexus 2000 Series Switches, Nexus 3000 Series Switches, Nexus 5500 Platform Switches, Nexus 5600 Platform Switches, Nexus 6000 Series Switches, Nexus 7000 Series Switches, Nexus 7700 Series Switches, Nexus 9000 Series Switches in standalone NX-OS mode. Cisco Bug IDs: CSCvf31132. Cisco NX-OS Contains a resource management vulnerability. Vendors have confirmed this vulnerability Bug ID CSCvf31132 It is released as.Service operation interruption (DoS) There is a possibility of being put into a state. Cisco MultilayerDirectorSwitches and so on are Cisco's switch products. Cisco NX-OS System Software is a set of software that runs on the switch. Cisco NX-OS System Software is prone to a denial-of-service vulnerability Attackers can exploit this issue to cause the application to consume excessive CPU resources, denying service to legitimate users
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-201801-1041", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "nx-os", "scope": "eq", "trust": 1.6, "vendor": "cisco", "version": "7.3\\(2\\)n1\\(0.6\\)" }, { "model": "nx-os", "scope": "eq", "trust": 1.6, "vendor": "cisco", "version": "8.8\\(3.5\\)s0" }, { "model": "nx-os", "scope": "eq", "trust": 1.6, "vendor": "cisco", "version": "8.3\\(0\\)kms\\(0.31\\)" }, { "model": "nexus series switches", "scope": "eq", "trust": 0.9, "vendor": "cisco", "version": "70000" }, { "model": "nx-os", "scope": "lt", "trust": 0.8, "vendor": "cisco", "version": "7.3.2" }, { "model": "nexus series", "scope": "eq", "trust": 0.6, "vendor": "cisco", "version": "2000" }, { "model": "nexus series switche", "scope": "eq", "trust": 0.6, "vendor": "cisco", "version": "3000" }, { "model": "nexus series switches", "scope": "eq", "trust": 0.6, "vendor": "cisco", "version": "6000" }, { "model": "nexus series switches", "scope": "eq", "trust": 0.6, "vendor": "cisco", "version": "7700" }, { "model": "nexus platform switches", "scope": "eq", "trust": 0.6, "vendor": "cisco", "version": "5600" }, { "model": "nexus platform switches", "scope": "eq", "trust": 0.6, "vendor": "cisco", "version": "5500" }, { "model": "multilayer director switches", "scope": null, "trust": 0.6, "vendor": "cisco", "version": null }, { "model": "nx-os", "scope": "eq", "trust": 0.3, "vendor": "cisco", "version": "0" }, { "model": "nexus series switches", "scope": "eq", "trust": 0.3, "vendor": "cisco", "version": "77000" }, { "model": "nexus series switches", "scope": "eq", "trust": 0.3, "vendor": "cisco", "version": "60000" }, { "model": "nexus platform switches", "scope": "eq", "trust": 0.3, "vendor": "cisco", "version": "56000" }, { "model": "nexus platform switches", "scope": "eq", "trust": 0.3, "vendor": "cisco", "version": "55000" }, { "model": "nexus series switches", "scope": "eq", "trust": 0.3, "vendor": "cisco", "version": "30000" }, { "model": "nexus series switches", "scope": "eq", "trust": 0.3, "vendor": "cisco", "version": "20000" }, { "model": "multilayer director switches", "scope": "eq", "trust": 0.3, "vendor": "cisco", "version": "0" } ], "sources": [ { "db": "CNVD", "id": "CNVD-2018-02051" }, { "db": "BID", "id": "102753" }, { "db": "JVNDB", "id": "JVNDB-2018-001514" }, { "db": "NVD", "id": "CVE-2018-0090" }, { "db": "CNNVD", "id": "CNNVD-201801-629" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:cisco:nx-os:7.3\\(2\\)n1\\(0.6\\):*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:cisco:nx-os:8.3\\(0\\)kms\\(0.31\\):*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:cisco:nx-os:8.8\\(3.5\\)s0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" } ] } ], "sources": [ { "db": "NVD", "id": "CVE-2018-0090" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Cisco", "sources": [ { "db": "BID", "id": "102753" } ], "trust": 0.3 }, "cve": "CVE-2018-0090", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "acInsufInfo": false, "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "author": "NVD", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "exploitabilityScore": 10.0, "impactScore": 2.9, "integrityImpact": "NONE", "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "trust": 1.0, "userInteractionRequired": false, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0" }, { "acInsufInfo": null, "accessComplexity": "Low", "accessVector": "Network", "authentication": "None", "author": "NVD", "availabilityImpact": "Partial", "baseScore": 5.0, "confidentialityImpact": "None", "exploitabilityScore": null, "id": "CVE-2018-0090", "impactScore": null, "integrityImpact": "None", "obtainAllPrivilege": null, "obtainOtherPrivilege": null, "obtainUserPrivilege": null, "severity": "Medium", "trust": 0.8, "userInteractionRequired": null, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0" }, { "accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "author": "CNVD", "availabilityImpact": "PARTIAL", "baseScore": 5.6, "confidentialityImpact": "NONE", "exploitabilityScore": 3.9, "id": "CNVD-2018-02051", "impactScore": 7.8, "integrityImpact": "COMPLETE", "severity": "MEDIUM", "trust": 0.6, "vectorString": "AV:L/AC:L/Au:N/C:N/I:C/A:P", "version": "2.0" }, { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "author": "VULHUB", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "exploitabilityScore": 10.0, "id": "VHN-118292", "impactScore": 2.9, "integrityImpact": "NONE", "severity": "MEDIUM", "trust": 0.1, "vectorString": "AV:N/AC:L/AU:N/C:N/I:N/A:P", "version": "2.0" } ], "cvssV3": [ { "attackComplexity": "LOW", "attackVector": "NETWORK", "author": "NVD", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "exploitabilityScore": 3.9, "impactScore": 3.6, "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "trust": 1.0, "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" }, { "attackComplexity": "Low", "attackVector": "Network", "author": "NVD", "availabilityImpact": "High", "baseScore": 7.5, "baseSeverity": "High", "confidentialityImpact": "None", "exploitabilityScore": null, "id": "CVE-2018-0090", "impactScore": null, "integrityImpact": "None", "privilegesRequired": "None", "scope": "Unchanged", "trust": 0.8, "userInteraction": "None", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" } ], "severity": [ { "author": "NVD", "id": "CVE-2018-0090", "trust": 1.8, "value": "HIGH" }, { "author": "CNVD", "id": "CNVD-2018-02051", "trust": 0.6, "value": "MEDIUM" }, { "author": "CNNVD", "id": "CNNVD-201801-629", "trust": 0.6, "value": "HIGH" }, { "author": "VULHUB", "id": "VHN-118292", "trust": 0.1, "value": "MEDIUM" } ] } ], "sources": [ { "db": "CNVD", "id": "CNVD-2018-02051" }, { "db": "VULHUB", "id": "VHN-118292" }, { "db": "JVNDB", "id": "JVNDB-2018-001514" }, { "db": "NVD", "id": "CVE-2018-0090" }, { "db": "CNNVD", "id": "CNNVD-201801-629" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "A vulnerability in management interface access control list (ACL) configuration of Cisco NX-OS System Software could allow an unauthenticated, remote attacker to bypass configured ACLs on the management interface. This could allow traffic to be forwarded to the NX-OS CPU for processing, leading to high CPU utilization and a denial of service (DoS) condition. The vulnerability is due to a bad code fix in the 7.3.2 code train that could allow traffic to the management interface to be misclassified and not match the proper configured ACLs. An attacker could exploit this vulnerability by sending crafted traffic to the management interface. An exploit could allow the attacker to bypass the configured management interface ACLs and impact the CPU of the targeted device, resulting in a DoS condition. This vulnerability affects the following Cisco products running Cisco NX-OS System Software: Multilayer Director Switches, Nexus 2000 Series Switches, Nexus 3000 Series Switches, Nexus 5500 Platform Switches, Nexus 5600 Platform Switches, Nexus 6000 Series Switches, Nexus 7000 Series Switches, Nexus 7700 Series Switches, Nexus 9000 Series Switches in standalone NX-OS mode. Cisco Bug IDs: CSCvf31132. Cisco NX-OS Contains a resource management vulnerability. Vendors have confirmed this vulnerability Bug ID CSCvf31132 It is released as.Service operation interruption (DoS) There is a possibility of being put into a state. Cisco MultilayerDirectorSwitches and so on are Cisco\u0027s switch products. Cisco NX-OS System Software is a set of software that runs on the switch. Cisco NX-OS System Software is prone to a denial-of-service vulnerability\nAttackers can exploit this issue to cause the application to consume excessive CPU resources, denying service to legitimate users", "sources": [ { "db": "NVD", "id": "CVE-2018-0090" }, { "db": "JVNDB", "id": "JVNDB-2018-001514" }, { "db": "CNVD", "id": "CNVD-2018-02051" }, { "db": "BID", "id": "102753" }, { "db": "VULHUB", "id": "VHN-118292" } ], "trust": 2.52 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2018-0090", "trust": 3.4 }, { "db": "BID", "id": "102753", "trust": 2.6 }, { "db": "SECTRACK", "id": "1040247", "trust": 1.7 }, { "db": "JVNDB", "id": "JVNDB-2018-001514", "trust": 0.8 }, { "db": "CNNVD", "id": "CNNVD-201801-629", "trust": 0.7 }, { "db": "CNVD", "id": "CNVD-2018-02051", "trust": 0.6 }, { "db": "VULHUB", "id": "VHN-118292", "trust": 0.1 } ], "sources": [ { "db": "CNVD", "id": "CNVD-2018-02051" }, { "db": "VULHUB", "id": "VHN-118292" }, { "db": "BID", "id": "102753" }, { "db": "JVNDB", "id": "JVNDB-2018-001514" }, { "db": "NVD", "id": "CVE-2018-0090" }, { "db": "CNNVD", "id": "CNNVD-201801-629" } ] }, "id": "VAR-201801-1041", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "CNVD", "id": "CNVD-2018-02051" }, { "db": "VULHUB", "id": "VHN-118292" } ], "trust": 1.305873218 }, "iot_taxonomy": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "category": [ "Network device" ], "sub_category": null, "trust": 0.6 } ], "sources": [ { "db": "CNVD", "id": "CNVD-2018-02051" } ] }, "last_update_date": "2023-12-18T14:01:22.243000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "cisco-sa-20180117-nxos", "trust": 0.8, "url": "https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20180117-nxos" }, { "title": "Patch for Cisco NX-OS System Software Management Denial of Service Vulnerability", "trust": 0.6, "url": "https://www.cnvd.org.cn/patchinfo/show/114503" }, { "title": "Multiple Cisco product Cisco NX-OS System Software Security vulnerabilities", "trust": 0.6, "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=77809" } ], "sources": [ { "db": "CNVD", "id": "CNVD-2018-02051" }, { "db": "JVNDB", "id": "JVNDB-2018-001514" }, { "db": "CNNVD", "id": "CNNVD-201801-629" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-400", "trust": 1.9 } ], "sources": [ { "db": "VULHUB", "id": "VHN-118292" }, { "db": "JVNDB", "id": "JVNDB-2018-001514" }, { "db": "NVD", "id": "CVE-2018-0090" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 2.6, "url": "https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20180117-nxos" }, { "trust": 1.7, "url": "http://www.securityfocus.com/bid/102753" }, { "trust": 1.7, "url": "http://www.securitytracker.com/id/1040247" }, { "trust": 0.8, "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-0090" }, { "trust": 0.8, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-0090" }, { "trust": 0.3, "url": "http://www.cisco.com/" } ], "sources": [ { "db": "CNVD", "id": "CNVD-2018-02051" }, { "db": "VULHUB", "id": "VHN-118292" }, { "db": "BID", "id": "102753" }, { "db": "JVNDB", "id": "JVNDB-2018-001514" }, { "db": "NVD", "id": "CVE-2018-0090" }, { "db": "CNNVD", "id": "CNNVD-201801-629" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "CNVD", "id": "CNVD-2018-02051" }, { "db": "VULHUB", "id": "VHN-118292" }, { "db": "BID", "id": "102753" }, { "db": "JVNDB", "id": "JVNDB-2018-001514" }, { "db": "NVD", "id": "CVE-2018-0090" }, { "db": "CNNVD", "id": "CNNVD-201801-629" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2018-01-26T00:00:00", "db": "CNVD", "id": "CNVD-2018-02051" }, { "date": "2018-01-18T00:00:00", "db": "VULHUB", "id": "VHN-118292" }, { "date": "2018-01-17T00:00:00", "db": "BID", "id": "102753" }, { "date": "2018-02-22T00:00:00", "db": "JVNDB", "id": "JVNDB-2018-001514" }, { "date": "2018-01-18T06:29:00.470000", "db": "NVD", "id": "CVE-2018-0090" }, { "date": "2018-01-22T00:00:00", "db": "CNNVD", "id": "CNNVD-201801-629" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2018-01-26T00:00:00", "db": "CNVD", "id": "CNVD-2018-02051" }, { "date": "2019-10-09T00:00:00", "db": "VULHUB", "id": "VHN-118292" }, { "date": "2018-01-17T00:00:00", "db": "BID", "id": "102753" }, { "date": "2018-02-22T00:00:00", "db": "JVNDB", "id": "JVNDB-2018-001514" }, { "date": "2019-10-09T23:31:12.627000", "db": "NVD", "id": "CVE-2018-0090" }, { "date": "2019-10-17T00:00:00", "db": "CNNVD", "id": "CNNVD-201801-629" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "remote", "sources": [ { "db": "CNNVD", "id": "CNNVD-201801-629" } ], "trust": 0.6 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Cisco NX-OS Resource management vulnerability", "sources": [ { "db": "JVNDB", "id": "JVNDB-2018-001514" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "resource management error", "sources": [ { "db": "CNNVD", "id": "CNNVD-201801-629" } ], "trust": 0.6 } }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.