cnvd - cnvd-2016-09439

cnvd-2016-09439

Vulnerability from cnvd

Title: Cisco NX-OS拒绝服务漏洞

Description:

Cisco NX-OS on Nexus 2000等是美国思科（Cisco）公司的一套运行于Nexus 2000等系列设备中的操作系统。

Cisco NX-OS S4.1至7.3版本和11.0至11.2版本中的DHCPv4中继代理的现实过程存在拒绝服务漏洞，远程攻击者可通过发送畸形的DHCPv4数据包，利用该漏洞造成拒绝服务（DHCP进程或设备崩溃）。

Severity: 高

Patch Name: Cisco NX-OS拒绝服务漏洞的补丁

Patch Description:

Cisco NX-OS on Nexus 2000等是美国思科（Cisco）公司的一套运行于Nexus 2000等系列设备中的操作系统。

Cisco NX-OS S4.1至7.3版本和11.0至11.2版本中的DHCPv4中继代理的现实过程存在拒绝服务漏洞，远程攻击者可通过发送畸形的DHCPv4数据包，利用该漏洞造成拒绝服务（DHCP进程或设备崩溃）。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

目前厂商已经发布了升级补丁以修复此安全问题，补丁获取链接： https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-dhcp2

Reference: http://www.securityfocus.com/bid/93419 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-dhcp2

Impacted products

Name
['Cisco Nexus 3000 Series Switche', 'Cisco Nexus 7000 series switches', 'Cisco Nexus 5000 Series Switches', 'Cisco Nexus 6000 Series Switches', 'Cisco Nexus 9000 Series Switches in NX-OS mode', 'Cisco Nexus 9000 Series Switches in Application Centric Infrastructure (ACI) mode', 'Cisco Nexus 7700 Series Switches', 'Cisco Nexus 5600 Platform Switches', 'Cisco Nexus 5500 Platform Switches', 'Cisco Nexus 2000 Series Fabric Extenders', 'Cisco Nexus 3500 Platform Switches']

Name

['Cisco Nexus 3000 Series Switche', 'Cisco Nexus 7000 series switches', 'Cisco Nexus 5000 Series Switches', 'Cisco Nexus 6000 Series Switches', 'Cisco Nexus 9000 Series Switches in NX-OS mode', 'Cisco Nexus 9000 Series Switches in Application Centric Infrastructure (ACI) mode', 'Cisco Nexus 7700 Series Switches', 'Cisco Nexus 5600 Platform Switches', 'Cisco Nexus 5500 Platform Switches', 'Cisco Nexus 2000 Series Fabric Extenders', 'Cisco Nexus 3500 Platform Switches']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "93419"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2015-6393"
    }
  },
  "description": "Cisco NX-OS on Nexus 2000\u7b49\u662f\u7f8e\u56fd\u601d\u79d1\uff08Cisco\uff09\u516c\u53f8\u7684\u4e00\u5957\u8fd0\u884c\u4e8eNexus 2000\u7b49\u7cfb\u5217\u8bbe\u5907\u4e2d\u7684\u64cd\u4f5c\u7cfb\u7edf\u3002\r\n\r\nCisco NX-OS S4.1\u81f37.3\u7248\u672c\u548c11.0\u81f311.2\u7248\u672c\u4e2d\u7684DHCPv4\u4e2d\u7ee7\u4ee3\u7406\u7684\u73b0\u5b9e\u8fc7\u7a0b\u5b58\u5728\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff0c\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u53d1\u9001\u7578\u5f62\u7684DHCPv4\u6570\u636e\u5305\uff0c\u5229\u7528\u8be5\u6f0f\u6d1e\u9020\u6210\u62d2\u7edd\u670d\u52a1\uff08DHCP\u8fdb\u7a0b\u6216\u8bbe\u5907\u5d29\u6e83\uff09\u3002",
  "discovererName": "Cisco",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-dhcp2",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2016-09439",
  "openTime": "2016-10-19",
  "patchDescription": "Cisco NX-OS on Nexus 2000\u7b49\u662f\u7f8e\u56fd\u601d\u79d1\uff08Cisco\uff09\u516c\u53f8\u7684\u4e00\u5957\u8fd0\u884c\u4e8eNexus 2000\u7b49\u7cfb\u5217\u8bbe\u5907\u4e2d\u7684\u64cd\u4f5c\u7cfb\u7edf\u3002\r\n\r\nCisco NX-OS S4.1\u81f37.3\u7248\u672c\u548c11.0\u81f311.2\u7248\u672c\u4e2d\u7684DHCPv4\u4e2d\u7ee7\u4ee3\u7406\u7684\u73b0\u5b9e\u8fc7\u7a0b\u5b58\u5728\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff0c\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u53d1\u9001\u7578\u5f62\u7684DHCPv4\u6570\u636e\u5305\uff0c\u5229\u7528\u8be5\u6f0f\u6d1e\u9020\u6210\u62d2\u7edd\u670d\u52a1\uff08DHCP\u8fdb\u7a0b\u6216\u8bbe\u5907\u5d29\u6e83\uff09\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Cisco NX-OS\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Cisco Nexus 3000 Series Switche",
      "Cisco Nexus 7000 series switches",
      "Cisco Nexus 5000 Series Switches",
      "Cisco Nexus 6000 Series Switches",
      "Cisco Nexus 9000 Series Switches in NX-OS mode",
      "Cisco Nexus 9000 Series Switches in Application Centric Infrastructure (ACI) mode",
      "Cisco Nexus 7700 Series Switches",
      "Cisco Nexus 5600 Platform Switches",
      "Cisco Nexus 5500 Platform Switches",
      "Cisco Nexus 2000 Series Fabric Extenders",
      "Cisco Nexus 3500 Platform Switches"
    ]
  },
  "referenceLink": "http://www.securityfocus.com/bid/93419\r\nhttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-dhcp2",
  "serverity": "\u9ad8",
  "submitTime": "2016-10-12",
  "title": "Cisco NX-OS\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e"
}

CVE-2015-6393 (GCVE-0-2015-6393)

Vulnerability from cvelistv5

Published

2016-10-06 10:00

Modified

2024-08-06 07:22

Severity ?

CWE

Summary

Cisco NX-OS 4.1 through 7.3 and 11.0 through 11.2 on Nexus 2000, 3000, 3500, 5000, 5500, 5600, 6000, 7000, 7700, and 9000 devices allows remote attackers to cause a denial of service (device crash) via malformed IPv4 DHCP packets to the DHCPv4 relay agent, aka Bug IDs CSCuq39250, CSCus21733, CSCus21739, CSCut76171, and CSCux67182.

References

▼	URL	Tags
	http://www.securityfocus.com/bid/93419	vdb-entry, x_refsource_BID
	http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-dhcp2	vendor-advisory, x_refsource_CISCO
	http://www.securitytracker.com/id/1036949	vdb-entry, x_refsource_SECTRACK

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T07:22:21.145Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "93419",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/93419"
          },
          {
            "name": "20161005 Cisco NX-OS Software Malformed DHCPv4 Packet Denial of Service Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-dhcp2"
          },
          {
            "name": "1036949",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1036949"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-10-05T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cisco NX-OS 4.1 through 7.3 and 11.0 through 11.2 on Nexus 2000, 3000, 3500, 5000, 5500, 5600, 6000, 7000, 7700, and 9000 devices allows remote attackers to cause a denial of service (device crash) via malformed IPv4 DHCP packets to the DHCPv4 relay agent, aka Bug IDs CSCuq39250, CSCus21733, CSCus21739, CSCut76171, and CSCux67182."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-07-29T09:57:01",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "93419",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/93419"
        },
        {
          "name": "20161005 Cisco NX-OS Software Malformed DHCPv4 Packet Denial of Service Vulnerability",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-dhcp2"
        },
        {
          "name": "1036949",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1036949"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@cisco.com",
          "ID": "CVE-2015-6393",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cisco NX-OS 4.1 through 7.3 and 11.0 through 11.2 on Nexus 2000, 3000, 3500, 5000, 5500, 5600, 6000, 7000, 7700, and 9000 devices allows remote attackers to cause a denial of service (device crash) via malformed IPv4 DHCP packets to the DHCPv4 relay agent, aka Bug IDs CSCuq39250, CSCus21733, CSCus21739, CSCut76171, and CSCux67182."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "93419",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/93419"
            },
            {
              "name": "20161005 Cisco NX-OS Software Malformed DHCPv4 Packet Denial of Service Vulnerability",
              "refsource": "CISCO",
              "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-dhcp2"
            },
            {
              "name": "1036949",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1036949"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2015-6393",
    "datePublished": "2016-10-06T10:00:00",
    "dateReserved": "2015-08-17T00:00:00",
    "dateUpdated": "2024-08-06T07:22:21.145Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted