NVD Vulnerability Detail

CVE-2018-0090

Summary	A vulnerability in management interface access control list (ACL) configuration of Cisco NX-OS System Software could allow an unauthenticated, remote attacker to bypass configured ACLs on the management interface. This could allow traffic to be forwarded to the NX-OS CPU for processing, leading to high CPU utilization and a denial of service (DoS) condition. The vulnerability is due to a bad code fix in the 7.3.2 code train that could allow traffic to the management interface to be misclassified and not match the proper configured ACLs. An attacker could exploit this vulnerability by sending crafted traffic to the management interface. An exploit could allow the attacker to bypass the configured management interface ACLs and impact the CPU of the targeted device, resulting in a DoS condition. This vulnerability affects the following Cisco products running Cisco NX-OS System Software: Multilayer Director Switches, Nexus 2000 Series Switches, Nexus 3000 Series Switches, Nexus 5500 Platform Switches, Nexus 5600 Platform Switches, Nexus 6000 Series Switches, Nexus 7000 Series Switches, Nexus 7700 Series Switches, Nexus 9000 Series Switches in standalone NX-OS mode. Cisco Bug IDs: CSCvf31132.
Publication Date	Jan. 18, 2018, 3:29 p.m.
Registration Date	March 1, 2021, 6:35 p.m.
Last Update	Nov. 21, 2024, 12:37 p.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://www.securityfocus.com/bid/102753	Third Party Advisory VDB Entry
2	http://www.securityfocus.com/bid/102753	Third Party Advisory VDB Entry
3	http://www.securitytracker.com/id/1040247	Third Party Advisory VDB Entry
4	http://www.securitytracker.com/id/1040247	Third Party Advisory VDB Entry
5	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-nxos	Vendor Advisory
6	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-nxos	Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-400	リソースの枯渇	https://cwe.mitre.org/data/definitions/400.html

JVN Vulnerability Information

Cisco NX-OS におけるリソース管理に関する脆弱性

Title	Cisco NX-OS におけるリソース管理に関する脆弱性
Summary	Cisco NX-OS には、リソース管理に関する脆弱性が存在します。ベンダは、本脆弱性を Bug ID CSCvf31132 として公開しています。
Possible impacts	サービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Jan. 17, 2018, midnight
Registration Date	Feb. 22, 2018, 2:45 p.m.
Last Update	Feb. 22, 2018, 2:45 p.m.

Affected System

シスコシステムズ

Cisco NX-OS 7.3.2 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2018-0090	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0090
National Vulnerability Database (NVD)
2	CVE-2018-0090	https://nvd.nist.gov/vuln/detail/CVE-2018-0090

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-400	https://cwe.mitre.org/data/definitions/400.html

ベンダー情報

No	Name	URL
Cisco Security Advisory
1	cisco-sa-20180117-nxos	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-nxos

Change Log

No	Changed Details	Date of change
1	[2018年02月22日] 掲載	Feb. 22, 2018, 2:45 p.m.