Cisco NX-OS Virtual Shell Session Management resource consumption

Summaryinfo

A vulnerability was found in Cisco NX-OS. It has been classified as problematic. This issue affects some unknown processing of the component Virtual Shell Session Management. This manipulation causes resource consumption. This vulnerability appears as CVE-2019-1965. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as problematic was found in Cisco NX-OS (Router Operating System) (unknown version). Affected by this vulnerability is an unknown code block of the component Virtual Shell Session Management. The manipulation with an unknown input leads to a resource consumption vulnerability. The CWE definition for the vulnerability is CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. As an impact it is known to affect availability. The summary by CVE is:

A vulnerability in the Virtual Shell (VSH) session management for Cisco NX-OS Software could allow an authenticated, remote attacker to cause a VSH process to fail to delete upon termination. This can lead to a build-up of VSH processes that overtime can deplete system memory. When there is no system memory available, this can cause unexpected system behaviors and crashes. The vulnerability is due to the VSH process not being properly deleted when a remote management connection to the device is disconnected. An attacker could exploit this vulnerability by repeatedly performing a remote management connection to the device and terminating the connection in an unexpected manner. A successful exploit could allow the attacker to cause the VSH processes to fail to delete, which can lead to a system-wide denial of service (DoS) condition. The attacker must have valid user credentials to log in to the device using the remote management connection.

The weakness was presented 08/28/2019 as cisco-sa-20190828-nxos-memleak as confirmed advisory (Website). The advisory is shared at tools.cisco.com. This vulnerability is known as CVE-2019-1965 since 12/06/2018. The attack can be launched remotely. The requirement for exploitation is a single authentication. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

Upgrading eliminates this vulnerability.

See VDB-141012 and VDB-141010 for similar entries. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Router Operating System

Vendor

• Cisco

Name

• NX-OS

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion