Denial of service in Cisco Nexus 9000 Series Switches in ACI Mode

1) Denial of service

EUVDB-ID: #VU786

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2015-6392

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote unathenticated user to cause DoS conditions on the target system.
The weakness is caused by improper validation of the DHCPv4 packets. By sending a specially crafted DHCPv4 packets attackers can cause the DHCP process or device to crash.
Succesfull exploitation of the vulnerability results in denial of service on the vulnerable system.

Mitigation

Update Cisco Nexus 5000 Series Switches to 5.2(1)N1(9a).
Update Cisco Nexus 2000, 5500, 5600, and 6000 Series Switches to 7.1(4)N1(1), 7.2(2)N1(1) or 7.3(0)N1(1).
Update Cisco Nexus 7000 and 7700 Series Switches to 7.2(2)D1(1) or 7.3(1)D1(1).
Update Cisco Nexus 9000 Series Switches in ACI Mode to 11.1(1j).
Update Cisco Nexus 9000 Series Switches in NX-OS Mode to 7.0(3)I4(1).

Vulnerable software versions

Cisco Nexus 9000 Series Switches in ACI Mode: 11.0 - 11.1

Cisco Nexus 9000 Series Switches NX-OS Mode: 6.1 - 7.0

Cisco Nexus 7700 Series Switches: 5.0 - 7.3

Cisco Nexus 7000 Series Switches: 5.0 - 7.3

Cisco Nexus 5000 Series Switches: 5.1 - 5.2

Cisco Nexus 2000 Series Switches: 5.2 - 7.3

Cisco Nexus 6000 Series Switches: 5.2 - 7.3

Cisco Nexus 5600 Series Switches: 5.2 - 7.3

CPE2.3

• cpe:2.3:h:cisco_systems:cisco_nexus_9000_series_switches_in_aci_mode:11.0:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_nexus_9000_series_switches_in_aci_mode:11.1:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_nexus_9000_series_switches_nx-os_mode:6.1:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_nexus_9000_series_switches_nx-os_mode:7.0:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_nexus_7700_series_switches:5.0:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_nexus_7700_series_switches:5.1:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_nexus_7700_series_switches:5.2:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_nexus_7000_series_switches:5.0:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_nexus_7000_series_switches:5.1:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_nexus_7000_series_switches:5.2:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_nexus_5000_series_switches:5.1:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_nexus_2000_series_switches:5.2:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_nexus_6000_series_switches:5.2:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_nexus_5600_series_switches:5.2:*:*:*:*:*:*:*

External links

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-dhcp1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.