Denial of Service in Cisco Nexus 1000 Series Switches

1) Denial of Service

EUVDB-ID: #VU788

Risk: Low

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-1454

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote unauthenticated user to cause DoS conditions on the target system.
The weakness is caused by insufficient input validation of the BGP update messages. By sending such massages attackers can cause the affected device reload.
Successful exploitation of the vulnerability results in denial of service on the vulnerable system.

Mitigation

Update Cisco Nexus 1000 Series Switches to 5.2(1)SV3(1.15).
Update Cisco Nexus 3000 Series Switches to 6.0(2)U6(7) or 7.0(3)I4(1).
Update Cisco Nexus 3500 Series Switches to 6.0(2)A8(1).
Update Cisco Nexus 2000, 5500, 6000 Series Switches to 7.1(4)N1(1), 7.2(2)N1(1) or 7.3(0)N1(1).
Update Cisco Nexus 7000, 7700Series Switches to 7.2(2)D1(1) or 7.3(1)D1(1).
Update Cisco Nexus 9000 Series Switches in ACI Mode to 11.1(1j).
Update Cisco Nexus 9000 Series Switches in NX-OS Mode to 7.0(3)I4(1)

Vulnerable software versions

Cisco Nexus 1000 Series Switches: 4.2 - 5.2

Cisco Nexus 3000 Series Switches: 6.0 - 7.0

Nexus 3500 Series Switches: 6.0

Cisco Nexus 5000 Series Switches: 5.1 - 5.2

Cisco Nexus 2000 Series Switches: 5.2 - 7.3

Cisco Nexus 5600 Series Switches: 5.2 - 7.3

Cisco Nexus 7000 Series Switches: 5.0 - 7.3

Cisco Nexus 7700 Series Switches: 5.0 - 7.3

Cisco Nexus 9000 Series Switches in ACI Mode: 11.0 - 11.1

Cisco Nexus 9000 Series Switches NX-OS Mode: 6.1 - 7.0

CPE2.3

• cpe:2.3:h:cisco_systems:cisco_nexus_1000_series_switches:4.2:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_nexus_1000_series_switches:5.2:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_nexus_3000_series_switches:6.0:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_nexus_3000_series_switches:6.1:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_nexus_3000_series_switches:7.0:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:nexus_3500_series_switches:6.0:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_nexus_5000_series_switches:5.1:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_nexus_5000_series_switches:5.2:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_nexus_2000_series_switches:5.2:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_nexus_2000_series_switches:6.0:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_nexus_5600_series_switches:5.2:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_nexus_7000_series_switches:5.0:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_nexus_7700_series_switches:5.0:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_nexus_9000_series_switches_in_aci_mode:11.0:*:*:*:*:*:*:*
• cpe:2.3:h:cisco_systems:cisco_nexus_9000_series_switches_nx-os_mode:6.1:*:*:*:*:*:*:*

External links

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-bgp

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.