Information disclosure in Cisco Nexus 9000 Series Switches - CVE-2016-1455

Vulnerability identifier: #VU779

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-1455

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote unauthenticared user to potentially sensitive information.
The weakness is caused by insufficient access control. By connecting to TCP or UDP ports on the target system attackers can cause iptables configuration flaw that may lets to access important files.
Successful exploitation of the vulnerability results in information disclosure on the vulnerable system.

Cisco Nexus 9000 Series Switches
Ubuntu
linux-image-6.5.0-44-generic (Ubuntu package)
linux-image-6.5.0-44-generic-64k (Ubuntu package)
linux-image-generic (Ubuntu package)
linux-image-generic-64k (Ubuntu package)
linux-image-generic-lpae (Ubuntu package)
linux-image-kvm (Ubuntu package)
linux-image-virtual (Ubuntu package)
linux-image-virtual-hwe-22.04 (Ubuntu package)
linux-image-raspi (Ubuntu package)
linux-image-raspi-nolpae (Ubuntu package)
linux-image-6.5.0-1020-raspi (Ubuntu package)
linux-image-6.5.0-1023-nvidia (Ubuntu package)
linux-image-6.5.0-1023-nvidia-64k (Ubuntu package)
linux-image-nvidia-hwe-22.04 (Ubuntu package)
linux-image-nvidia-64k-hwe-22.04 (Ubuntu package)
linux-image-nvidia-64k-6.5 (Ubuntu package)
linux-image-nvidia-6.5 (Ubuntu package)
linux-image-gcp (Ubuntu package)
linux-image-6.5.0-1024-gcp (Ubuntu package)

Update to version 7.0(3)I2(2e) or 7.0(3)I4(1).

linux-image-6.5.0-44-generic (Ubuntu package) - update to 6.5.0-44.44
linux-image-6.5.0-44-generic-64k (Ubuntu package) - update to 6.5.0-44.44
linux-image-generic (Ubuntu package) - update to 6.5.0.44.44
linux-image-generic-64k (Ubuntu package) - update to 6.5.0.44.44
linux-image-generic-lpae (Ubuntu package) - update to 6.5.0.44.44
linux-image-kvm (Ubuntu package) - update to 6.5.0.44.44
linux-image-virtual (Ubuntu package) - update to 6.5.0.44.44
linux-image-virtual-hwe-22.04 (Ubuntu package) - update to 6.5.0.44.44
linux-image-raspi (Ubuntu package) - update to 6.5.0.1020.21
linux-image-raspi-nolpae (Ubuntu package) - update to 6.5.0.1020.21
linux-image-6.5.0-1020-raspi (Ubuntu package) - update to 6.5.0-1020.23
linux-image-6.5.0-1023-nvidia (Ubuntu package) - update to 6.5.0-1023.24
linux-image-6.5.0-1023-nvidia-64k (Ubuntu package) - update to 6.5.0-1023.24
linux-image-nvidia-hwe-22.04 (Ubuntu package) - update to 6.5.0.1023.31
linux-image-nvidia-64k-hwe-22.04 (Ubuntu package) - update to 6.5.0.1023.31
linux-image-nvidia-64k-6.5 (Ubuntu package) - update to 6.5.0.1023.31
linux-image-nvidia-6.5 (Ubuntu package) - update to 6.5.0.1023.31
linux-image-gcp (Ubuntu package) - update to 6.5.0.1024.26
linux-image-6.5.0-1024-gcp (Ubuntu package) - update to 6.5.0-1024.26

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-n9kinfo

• Information disclosure in Cisco Nexus 9000 Series Switches
• Ubuntu update for linux