—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1

Cisco Security Advisory: Cisco NX-OS Software NX-API Arbitrary Code Execution Vulnerability

Advisory ID: cisco-sa-20180620-nxos-bo

Revision: 1.0

For Public Release: 2018 June 20 16:00 GMT

Last Updated: 2018 June 20 16:00 GMT

CVE ID(s): CVE-2018-0301

CVSS Score v(3): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

+———————————————————————

Summary

=======

A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to craft a packet to the management interface on an affected system, causing a buffer overflow.

The vulnerability is due to incorrect input validation in the authentication module of the NX-API subsystem. An attacker could exploit this vulnerability by sending a crafted HTTP or HTTPS packet to the management interface of an affected system with the NX-API feature enabled. An exploit could allow the attacker to execute arbitrary code as root.

Note: NX-API is disabled by default.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is available at the following link:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-nxos-bo [“https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-nxos-bo”]

This advisory is part of the June 2018 Cisco FXOS and NX-OS Software Security Advisory Collection, which includes 24 Cisco Security Advisories that describe 24 vulnerabilities. For a complete list of the advisories and links to them, see Cisco Event Response: June 2018 Cisco FXOS and NX-OS Software Security Advisory Collection [“https://tools.cisco.com/security/center/viewErp.x?alertId=ERP-67770”].

—–BEGIN PGP SIGNATURE—–

iQJ5BAEBAgBjBQJbKnqVXBxDaXNjbyBQcm9kdWN0IFNlY3VyaXR5IEluY2lkZW50
IFJlc3BvbnNlIFRlYW0gKENpc2NvIFBTSVJUIGtleSAyMDE4LTIwMTkpIDxwc2ly
dEBjaXNjby5jb20+AAoJEJa12PPJBfczA5UP/RONfMWnFAwB9o7cyK2ta9eWbmwb
XWZ4VxQXUkE42LTiAZTWzEzEneymuy2Vw4tfYdQyuXWAptjpoUqNjeV3x37XSLjl
YezaGVRw8EOaVi3D16noNw+WjPQ+JINQZ/NjOAsRbdQSwJICotqJ9s5QnXUsPb1a
roKXNOj8tchMaUBaGSi1neUT9oK7f+ndtMytWeMQqVG9GtTJ3NdNr3BDdyeItknM
vLqEDtJl4tfyAkQv5CU1m1kpuB+oXzas4l09qttcTqS+FCh8TZ20G0qVV9KI0T6L
Mn9DHVpZP9E5DYgbdTra005iv14MCnfaIGBFccA9RNKTifeBL3j2OSy38ZcmHNW5
DbyjAT+SM23Z7CFRskcEeBWWwsmXoxSeB/HRkrbRuqYog+0X8PGaAdIwESQddeIl
zufUwythsyb2xFzCgNMZh1dTVCqe05Ec91MHfKtx57nUDqKFZ0vVKO+Q9qVrcMrf
+pLAOy6ZtBWiHeIl5rra1vFPGHjEYnmEsVjzxebRKLeREsGAO4O+J6Z3uK+ocgjB
eCeI9GKyflFBmLvjgvx4uGLbkXH6s6N520uoECL9bTT3s7j7/KxphCDV+lv6p+9I
gdPfh7/Pc9aIAYP8hsgvGScAjlBxLSrB7lAEQpZSuZKj3NR303slt8ZNOucOunOE
A04L/a476EpOhgIH
=EQSD
—–END PGP SIGNATURE—–

_______________________________________________
cust-security-announce mailing list
cust-security-announce@cisco.com
To unsubscribe, send the command “unsubscribe” in the subject of your message to cust-security-announce-leave@cisco.com