Lucene search

CiscoCVE-2019-1901

HistoryJul 31, 2019 - 6:15 p.m.

CVE-2019-1901

2019-07-3118:15:11

CWE-119

cisco

web.nvd.nist.gov

cve-2019-1901

cisco

nexus 9000

aci mode

lldp

dos

buffer overflow

root privileges

CVSS2

8.3

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:A/AC:L/Au:N/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.1

Confidence

High

EPSS

0.001

Percentile

43.6%

JSON

A vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco Nexus 9000 Series Application Centric Infrastructure (ACI) Mode Switch Software could allow an adjacent, unauthenticated attacker to cause a denial of service (DoS) condition or execute arbitrary code with root privileges. The vulnerability is due to improper input validation of certain type, length, value (TLV) fields of the LLDP frame header. An attacker could exploit this vulnerability by sending a crafted LLDP packet to the targeted device. A successful exploit may lead to a buffer overflow condition that could either cause a DoS condition or allow the attacker to execute arbitrary code with root privileges. Note: This vulnerability cannot be exploited by transit traffic through the device; the crafted packet must be targeted to a directly connected interface. This vulnerability affects Cisco Nexus 9000 Series Fabric Switches in ACI mode if they are running a Cisco Nexus 9000 Series ACI Mode Switch Software release prior to 13.2(7f) or any 14.x release.

Affected configurations

Nvd

Vulners

Node

cisconexus_93108tc-exMatch-

cisconexus_93108tc-fxMatch-

cisconexus_93120txMatch-

cisconexus_93128txMatch-

cisconexus_93180lc-exMatch-

cisconexus_93180yc-exMatch-

cisconexus_93180yc-fxMatch-

cisconexus_9332pqMatch-

cisconexus_9336c-fx2Match-

cisconexus_9336pqMatch-

cisconexus_9348gc-fxpMatch-

cisconexus_9364cMatch-

cisconexus_9372pxMatch-

cisconexus_9372px-eMatch-

cisconexus_9372txMatch-

cisconexus_9372tx-eMatch-

cisconexus_9396pxMatch-

cisconexus_9396txMatch-

cisconexus_9504Match-

cisconexus_9508Match-

cisconexus_9516Match-

AND

cisconx-osRange<13.2\(7f\)

cisconx-osRange14.0\(1h\)–14.1\(2g\)

Node

cisconexus_93240yc-fx2Match-

cisconexus_9332cMatch-

AND

cisconx-osRange14.0\(1h\)–14.1\(2g\)

VendorProductVersionCPE
cisconexus_93108tc-ex-cpe:2.3:h:cisco:nexus_93108tc-ex:-:*:*:*:*:*:*:*
cisconexus_93108tc-fx-cpe:2.3:h:cisco:nexus_93108tc-fx:-:*:*:*:*:*:*:*
cisconexus_93120tx-cpe:2.3:h:cisco:nexus_93120tx:-:*:*:*:*:*:*:*
cisconexus_93128tx-cpe:2.3:h:cisco:nexus_93128tx:-:*:*:*:*:*:*:*
cisconexus_93180lc-ex-cpe:2.3:h:cisco:nexus_93180lc-ex:-:*:*:*:*:*:*:*
cisconexus_93180yc-ex-cpe:2.3:h:cisco:nexus_93180yc-ex:-:*:*:*:*:*:*:*
cisconexus_93180yc-fx-cpe:2.3:h:cisco:nexus_93180yc-fx:-:*:*:*:*:*:*:*
cisconexus_9332pq-cpe:2.3:h:cisco:nexus_9332pq:-:*:*:*:*:*:*:*
cisconexus_9336c-fx2-cpe:2.3:h:cisco:nexus_9336c-fx2:-:*:*:*:*:*:*:*
cisconexus_9336pq-cpe:2.3:h:cisco:nexus_9336pq:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	nexus_93108tc-ex	-	cpe:2.3:h:cisco:nexus_93108tc-ex:-:::::::*
cisco	nexus_93108tc-fx	-	cpe:2.3:h:cisco:nexus_93108tc-fx:-:::::::*
cisco	nexus_93120tx	-	cpe:2.3:h:cisco:nexus_93120tx:-:::::::*
cisco	nexus_93128tx	-	cpe:2.3:h:cisco:nexus_93128tx:-:::::::*
cisco	nexus_93180lc-ex	-	cpe:2.3:h:cisco:nexus_93180lc-ex:-:::::::*
cisco	nexus_93180yc-ex	-	cpe:2.3:h:cisco:nexus_93180yc-ex:-:::::::*
cisco	nexus_93180yc-fx	-	cpe:2.3:h:cisco:nexus_93180yc-fx:-:::::::*
cisco	nexus_9332pq	-	cpe:2.3:h:cisco:nexus_9332pq:-:::::::*
cisco	nexus_9336c-fx2	-	cpe:2.3:h:cisco:nexus_9336c-fx2:-:::::::*
cisco	nexus_9336pq	-	cpe:2.3:h:cisco:nexus_9336pq:-:::::::*

Rows per page:

1-10 of 241

CNA Affected

[
  {
    "product": "Cisco NX-OS System Software",
    "vendor": "Cisco",
    "versions": [
      {
        "lessThan": "13.2(7f)",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190731-nxos-bo

CVSS2

8.3

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:A/AC:L/Au:N/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.1

Confidence

High

EPSS

0.001

Percentile

43.6%

JSON

Related for CVE-2019-1901