CVE-2019-1616 : A vulnerability in the Cisco Fabric Services component of Cisco NX-OS Software c

A vulnerability in the Cisco Fabric Services component of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a buffer overflow, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient validation of Cisco Fabric Services packets. An attacker could exploit this vulnerability by sending a crafted Cisco Fabric Services packet to an affected device. A successful exploit could allow the attacker to cause a buffer overflow, resulting in process crashes and a DoS condition on the device. MDS 9000 Series Multilayer Switches are affected running software versions prior to 6.2(25), 8.1(1b), 8.3(1). Nexus 3000 Series Switches are affected running software versions prior to 7.0(3)I4(9) and 7.0(3)I7(4). Nexus 3500 Platform Switches are affected running software versions prior to 6.0(2)A8(10) and 7.0(3)I7(4). Nexus 3600 Platform Switches are affected running software versions prior to 7.0(3)F3(5) Nexus 7000 and 7700 Series Switches are affected running software versions prior to 6.2(22) and 8.2(3). Nexus 9000 Series Switches in Standalone NX-OS Mode are affected running software versions prior to 7.0(3)I4(9) and 7.0(3)I7(4). Nexus 9500 R-Series Line Cards and Fabric Modules are affected running software versions prior to 7.0(3)F3(5). UCS 6200, 6300, and 6400 Fabric Interconnects are affected running software versions prior to 3.2(3j) and 4.0(2a).

Published 2019-03-11 21:29:01

Updated 2019-10-09 23:47:31

Source Cisco Systems, Inc.

View at NVD, CVE.org

Vulnerability category: OverflowInput validationDenial of service

Products affected by CVE-2019-1616

Cisco » Nx-os
Versions from including (>=) 7.0\(3\)f3 and before (<) 7.0\(3\)f3\(3c\)
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Nexus 3600 » Version: N/A
Cisco » Nx-os
Versions from including (>=) 8.2 and before (<) 8.3\(1\)
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Mds 9000 » Version: N/A
Cisco » Nx-os
Versions from including (>=) 7.0\(3\) and before (<) 7.0\(3\)i7\(4\)
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Nexus 3500 » Version: N/A
Cisco » Nx-os
Versions from including (>=) 7.0\(3\)f1 and before (<) 7.0\(3\)f3\(3c\)
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Nexus 9500 » Version: N/A
Cisco » Nx-os
Versions from including (>=) 5.2 and before (<) 6.2\(25\)
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Mds 9000 » Version: N/A
Cisco » Nx-os
Versions from including (>=) 6.2 and before (<) 6.2\(22\)
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Nexus 7000 » Version: N/A
When used together with: Cisco » Nexus 7700 » Version: N/A
Cisco » Nx-os
Versions up to, including, (<=) 7.0\(3\)i4
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Nexus 3000 » Version: N/A
Cisco » Nx-os
Versions from including (>=) 7.0\(3\)i5 and before (<) 7.0\(3\)i7\(4\)
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Nexus 3000 » Version: N/A
Cisco » Nx-os
Versions from including (>=) 6.0\(2\)a8 and before (<) 6.0\(2\)a8\(10\)
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Nexus 3500 » Version: N/A
Cisco » Nx-os
Versions up to, including, (<=) 6.0\(2\)a8
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Nexus 3500 » Version: N/A
Cisco » Nx-os
Versions from including (>=) 7.2 and before (<) 8.2\(3\)
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Nexus 7000 » Version: N/A
When used together with: Cisco » Nexus 7700 » Version: N/A
Cisco » Nx-os
Versions before (<) 6.2\(22\)
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Nexus 7000 » Version: N/A
When used together with: Cisco » Nexus 7700 » Version: N/A
Cisco » Nx-os
Versions before (<) 7.0\(3\)i4\(9\)
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Nexus 9000 » Version: N/A
Cisco » Nx-os
Versions from including (>=) 7.3 and before (<) 8.1\(1b\)
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Mds 9000 » Version: N/A
Cisco » Nx-os
Versions from including (>=) 4.0 and before (<) 4.0\(2a\)
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Ucs 6200 » Version: N/A
When used together with: Cisco » Ucs 6300 » Version: N/A
When used together with: Cisco » Ucs 6400 » Version: N/A
Cisco » Nx-os
Versions from including (>=) 7.0\(3\)i4 and before (<) 7.0\(3\)i4\(9\)
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Nexus 3000 » Version: N/A
Cisco » Nx-os
Versions before (<) 3.2\(3j\)
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Ucs 6200 » Version: N/A
When used together with: Cisco » Ucs 6300 » Version: N/A
When used together with: Cisco » Ucs 6400 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2019-1616

EPSS FAQ

0.10%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 42 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-1616

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:N/A:P	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
7.5	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High
8.6	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H	3.9	4.0	Cisco Systems, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Changed Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2019-1616

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Assigned by: ykramarz@cisco.com (Secondary)
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2019-1616

http://www.securityfocus.com/bid/107395

Cisco NX-OS Software CVE-2019-1616 Remote Denial of Service Vulnerability
Third Party Advisory;VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-nxos-fabric-dos

Cisco NX-OS Software Cisco Fabric Services Denial of Service Vulnerability
Vendor Advisory

Jump to

Vulnerability Details : CVE-2019-1616

Products affected by CVE-2019-1616

Exploit prediction scoring system (EPSS) score for CVE-2019-1616

CVSS scores for CVE-2019-1616

CWE ids for CVE-2019-1616

References for CVE-2019-1616