Cisco NX-OS Malformed IP Packet Denial of Service Vulnerability

By On February 20, 2012 · 2 Comments

Summary

Cisco NX-OS Software is affected by a denial of service (DoS) vulnerability that could cause Cisco Nexus 1000v, 5000, and 7000 Series Switches that are running affected versions of Cisco NX-OS Software to reload when the IP stack processes a malformed IP packet.

Vulnerable Products

Cisco Nexus 1000v, 5000, and 7000 Series Switches that are running affected versions of Cisco NX-OS Software are affected by this vulnerability. The vulnerability is in the operating system’s IP stack; therefore, any feature that makes use of the services that are offered by the IP stack to process IP packets is affected.

Cisco NX-OS Software versions prior to the First Fixed Release version are affected. Refer to the Software Versions and Fixes section for details regarding fixed versions.

To determine the version of Cisco NX-OS Software that is running on a Cisco Nexus switch, administrators can log in to the device and issue the show version command to display the system banner.

Products Confirmed Not Vulnerable

Cisco NX-OS Software for products other than the Cisco Nexus 1000v, 5000, and 7000 Series Switches is not affected by this vulnerability. In particular, the following products that run Cisco NX-OS Software are not affected:

Cisco Nexus 2000 Series Switches
Cisco Nexus 3000 Series Switches
Cisco Nexus 4000 Series Switches
Unified Computing System (UCS)
Cisco MDS 9000 Series Multilayer Switches

No other Cisco products are currently known to be affected by this vulnerability.

This advisory is available at the following link:

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120215-nxos

Tagged with: • • • •
 
If you enjoyed this article, please consider sharing it!
Reddit FacebookTwitterDelicious
  • Paul Mann

    So let me get this straight – the systems with Cisco’s vaunted silicon that Jimmy Ray Purser likes to rave about are the ones affected by this issue.  Interesting.  Also interesting to note that the issue affects some platforms but not all – makes it seem they have a significant problem in their development platform and test platform if this is the case.  It’s certainly not a ‘single system binary’ like I can get with Arista or Juniper.  

  • Calin

    Indeed they have some problems with this products. I would like to know more about the “malformed” packet, but there is not too much explanation in this direction (for good reasons, of course).