Cisco NX-OS 802.1X input validation

Summaryinfo

A vulnerability was found in Cisco NX-OS. It has been declared as problematic. Affected by this issue is some unknown functionality of the component 802.1X. Such manipulation leads to input validation. This vulnerability is documented as CVE-2019-1594. The attack requires being on the local network. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Cisco NX-OS (Router Operating System) (version now known) and classified as problematic. Affected by this issue is some unknown processing of the component 802.1X. The manipulation with an unknown input leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Impacted is availability. CVE summarizes:

A vulnerability in the 802.1X implementation for Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to incomplete input validation of Extensible Authentication Protocol over LAN (EAPOL) frames. An attacker could exploit this vulnerability by sending a crafted EAPOL frame to an interface on the targeted device. A successful exploit could allow the attacker to cause the Layer 2 (L2) forwarding process to restart multiple times, leading to a system-level restart of the device and a DoS condition. Note: This vulnerability affects only NX-OS devices configured with 802.1X functionality. Cisco Nexus 1000V Switch for VMware vSphere devices are affected in versions prior to 5.2(1)SV3(1.4b). Nexus 3000 Series Switches are affected in versions prior to 7.0(3)I7(4). Nexus 3500 Platform Switches are affected in versions prior to 7.0(3)I7(4). Nexus 2000, 5500, 5600, and 6000 Series Switches are affected in versions prior to 7.3(5)N1(1) and 7.1(5)N1(1b). Nexus 7000 and 7700 Series Switches are affected in versions prior to 8.2(3). Nexus 9000 Series Fabric Switches in ACI Mode are affected in versions prior to 13.2(1l). Nexus 9000 Series Switches in Standalone NX-OS Mode are affected in versions prior to 7.0(3)I7(4).

The bug was discovered 03/06/2019. The weakness was released 03/06/2019 as cisco-sa-20190306-nx-os-lan-au as confirmed advisory (Website). The advisory is shared for download at tools.cisco.com. This vulnerability is handled as CVE-2019-1594 since 12/06/2018. Access to the local network is required for this attack to succeed. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available.

Upgrading eliminates this vulnerability.

Entries connected to this vulnerability are available at VDB-131397, VDB-131395, VDB-131394 and VDB-131393. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• Cisco

Name

• NX-OS

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion