Security restrictions bypass in Cisco MDS 9000 Series Multilayer Switches

1) Security restrictions bypass

EUVDB-ID: #VU780

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2015-0721

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote authenticated user to bypass authentication, authorization, and accounting (AAA) limitations.
The weakness exists due to incorrect handling of parameters passed during negotiation of an SSH connection. Attackers will manage to pass a malicious value as a part of login procedure that allows to bypass AAA restrictions and execute arbitrary commands.
Successful exploitation of the vulnerability results in AAA bypass and access to the vulnerable system.

Mitigation

Update Cisco Nexus 1000 to 5.2(1)SV3(1.15).
Update Cisco Nexus 3000 to 6.0(2)U6(7) or 7.0(3)I4(1).
Update Cisco Nexus 3500 to 6.0(2)A8(1).
Update Cisco Nexus 4000 to 4.1(2)E1(1p).
Update Cisco Nexus 5000 to 5.2(1)N1(9a).

Update Cisco Nexus 2000, 5500, 5600 and 6000 to 7.1(4)N1(1) , 7.2(2)N1(1) or 7.3(0)N1(1).
Update Cisco Nexus 7000 and 7700 to 7.2(2)D1(1) or 7.3(1)D1(1).
Update Cisco Nexus 9000 Series Switches NX-OS Mode to 7.0(3)I4(1).
Update Cisco MDS 9000 Series Multilayer Switches to 6.2(15) or 7.3(0)D1(1).

Vulnerable software versions

Cisco MDS 9000 Series Multilayer Switches: 5.2 - 7.3

Cisco Nexus 9000 Series Switches NX-OS Mode: 6.1 - 7.0

Cisco Nexus 6000 Series Switches: 5.2 - 7.3

Cisco Nexus 5600 Series Switches: 5.2 - 7.3

Cisco Nexus 5000 Series Switches: 5.1 - 7.3

Cisco Nexus 2000 Series Switches: 5.2 - 7.3

Cisco Nexus 4000 Series Switches: 4.1

Nexus 3500 Series Switches: 5.0 - 6.0

Cisco Nexus 3000 Series Switches: 6.0 - 7.0

Cisco Nexus 1000 Series Switches: 4.2 - 5.2

Cisco Nexus 7700 Series Switches: 5.0 - 7.3

External links

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-nxaaa

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.