CVE-2019-1617 : A vulnerability in the Fibre Channel over Ethernet (FCoE) N-port Virtualization

A vulnerability in the Fibre Channel over Ethernet (FCoE) N-port Virtualization (NPV) protocol implementation in Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition. The vulnerability is due to an incorrect processing of FCoE packets when the fcoe-npv feature is uninstalled. An attacker could exploit this vulnerability by sending a stream of FCoE frames from an adjacent host to an affected device. An exploit could allow the attacker to cause packet amplification to occur, resulting in the saturation of interfaces and a DoS condition. Nexus 9000 Series Switches in Standalone NX-OS Mode are affected running software versions prior to 7.0(3)I7(5) and 9.2(2).

Published 2019-03-11 21:29:01

Updated 2019-10-09 23:47:31

Source Cisco Systems, Inc.

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2019-1617

Cisco » Nx-os
Versions from including (>=) 7.0\(3\)i5 and before (<) 7.0\(3\)i7\(5\)
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » N9k-c92160yc-x » Version: N/A
When used together with: Cisco » N9k-c9236c » Version: N/A
When used together with: Cisco » N9k-c9272q » Version: N/A
When used together with: Cisco » N9k-c93180lc-ex » Version: N/A
When used together with: Cisco » N9k-c93180yc-ex » Version: N/A
When used together with: Cisco » N9k-c93180yc-fx » Version: N/A
When used together with: Cisco » N9k-x9732c-ex » Version: N/A
When used together with: Cisco » N9k-x9736c-fx » Version: N/A
Cisco » Nx-os
Versions from including (>=) 9.2 and before (<) 9.2\(2\)
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » N9k-c92160yc-x » Version: N/A
When used together with: Cisco » N9k-c9236c » Version: N/A
When used together with: Cisco » N9k-c9272q » Version: N/A
When used together with: Cisco » N9k-c93180lc-ex » Version: N/A
When used together with: Cisco » N9k-c93180yc-ex » Version: N/A
When used together with: Cisco » N9k-c93180yc-fx » Version: N/A
When used together with: Cisco » N9k-x9732c-ex » Version: N/A
When used together with: Cisco » N9k-x9736c-fx » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2019-1617

EPSS FAQ

0.13%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 49 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-1617

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.1	MEDIUM	AV:A/AC:L/Au:N/C:N/I:N/A:C	6.5	6.9	NIST
Access Vector: Adjacent Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Complete
7.4	HIGH	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H	2.8	4.0	NIST
Attack Vector: Adjacent Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Changed Confidentiality: None Integrity: None Availability: High
7.4	HIGH	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H	2.8	4.0	Cisco Systems, Inc.
Attack Vector: Adjacent Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Changed Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2019-1617

CWE-913 Improper Control of Dynamically-Managed Code Resources

The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.
Assigned by:
- nvd@nist.gov (Primary)
- ykramarz@cisco.com (Secondary)

References for CVE-2019-1617

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-nxos-npv-dos

Cisco Nexus 9000 Series Switches Standalone NX-OS Mode Fibre Channel over Ethernet NPV Denial of Service Vulnerability
Exploit;Vendor Advisory
http://www.securityfocus.com/bid/107336

Cisco Nexus 9000 Series Switches CVE-2019-1617 Denial of Service Vulnerability
Third Party Advisory;VDB Entry

Jump to

Vulnerability Details : CVE-2019-1617

Products affected by CVE-2019-1617

Exploit prediction scoring system (EPSS) score for CVE-2019-1617

CVSS scores for CVE-2019-1617

CWE ids for CVE-2019-1617

References for CVE-2019-1617