#VU780 Security restrictions bypass in Cisco Systems, Inc products - CVE-2015-0721
Published: October 5, 2016 / Updated: April 5, 2018
Vulnerability identifier: #VU780
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2015-0721
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Cisco MDS 9000 Series Multilayer Switches
Cisco Nexus 9000 Series Switches NX-OS Mode
Cisco Nexus 6000 Series Switches
Cisco Nexus 5600 Series Switches
Cisco Nexus 5000 Series Switches
Cisco Nexus 2000 Series Switches
Cisco Nexus 4000 Series Switches
Nexus 3500 Series Switches
Cisco Nexus 3000 Series Switches
Cisco Nexus 1000 Series Switches
Cisco Nexus 7700 Series Switches
Cisco MDS 9000 Series Multilayer Switches
Cisco Nexus 9000 Series Switches NX-OS Mode
Cisco Nexus 6000 Series Switches
Cisco Nexus 5600 Series Switches
Cisco Nexus 5000 Series Switches
Cisco Nexus 2000 Series Switches
Cisco Nexus 4000 Series Switches
Nexus 3500 Series Switches
Cisco Nexus 3000 Series Switches
Cisco Nexus 1000 Series Switches
Cisco Nexus 7700 Series Switches
Software vendor:
Cisco Systems, Inc
Cisco Systems, Inc
Description
The vulnerability allows a remote authenticated user to bypass authentication, authorization, and accounting (AAA) limitations.
The weakness exists due to incorrect handling of parameters passed during negotiation of an SSH connection. Attackers will manage to pass a malicious value as a part of login procedure that allows to bypass AAA restrictions and execute arbitrary commands.
Successful exploitation of the vulnerability results in AAA bypass and access to the vulnerable system.
The weakness exists due to incorrect handling of parameters passed during negotiation of an SSH connection. Attackers will manage to pass a malicious value as a part of login procedure that allows to bypass AAA restrictions and execute arbitrary commands.
Successful exploitation of the vulnerability results in AAA bypass and access to the vulnerable system.
Remediation
Update Cisco Nexus 1000 to 5.2(1)SV3(1.15).
Update Cisco Nexus 3000 to 6.0(2)U6(7) or 7.0(3)I4(1).
Update Cisco Nexus 3500 to 6.0(2)A8(1).
Update Cisco Nexus 4000 to 4.1(2)E1(1p).
Update Cisco Nexus 5000 to 5.2(1)N1(9a).
Update Cisco Nexus 2000, 5500, 5600 and 6000 to 7.1(4)N1(1) , 7.2(2)N1(1) or 7.3(0)N1(1).
Update Cisco Nexus 7000 and 7700 to 7.2(2)D1(1) or 7.3(1)D1(1).
Update Cisco Nexus 9000 Series Switches NX-OS Mode to 7.0(3)I4(1).
Update Cisco MDS 9000 Series Multilayer Switches to 6.2(15) or 7.3(0)D1(1).
Update Cisco Nexus 3000 to 6.0(2)U6(7) or 7.0(3)I4(1).
Update Cisco Nexus 3500 to 6.0(2)A8(1).
Update Cisco Nexus 4000 to 4.1(2)E1(1p).
Update Cisco Nexus 5000 to 5.2(1)N1(9a).
Update Cisco Nexus 7000 and 7700 to 7.2(2)D1(1) or 7.3(1)D1(1).
Update Cisco Nexus 9000 Series Switches NX-OS Mode to 7.0(3)I4(1).
Update Cisco MDS 9000 Series Multilayer Switches to 6.2(15) or 7.3(0)D1(1).