Summary

• Cisco Nexus, Cisco Unified Computing System (UCS), and Cisco 1000 Series Connected Grid Routers (CGR) are all based on the Cisco NX-OS operating system. These products are affected by one or more of the following vulnerabilities:
  

  • Cisco NX-OS Virtual Device Context SSH Privilege Escalation Vulnerability
  • Cisco NX-OS Virtual Device Context SSH Key Privilege Escalation Vulnerability
  • Cisco NX-OS-Based Products Smart Call Home Buffer Overflow Vulnerability
  • Cisco NX-OS Message Transfer Service Denial of Service Vulnerability 
    • No officially released images are affected

  Cisco has released software updates that address these vulnerabilities.
  
  This advisory is available at the following link:
  http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140521-nxos

Affected Products

• Cisco products running or based on the Cisco NX-OS Software high-speed routing and switching platform are affected by one or more of the vulnerabilities detailed in this advisory.

  Vulnerable Products

  The following products are vulnerable:
  
  

  	UCS 6100	UCS 6200	Nexus 9000	Nexus 7000	Nexus 6000	Nexus 5000	Nexus 4000	Nexus 3000	Nexus 1000v	MDS 9000	CGR 1000
  Cisco NX-OS Virtual Device Context SSH Privilege Escalation Vulnerability   CVE-2014-2200				X
  Cisco NX-OS Virtual Device Context SSH Key Privilege Escalation Vulnerability CVE-2013-1191				X
  Cisco NX-OS-Based Products Smart Call Home Buffer Overflow Vulnerability  CVE-2014-3261	X	X		X		X	X	X			X
  Cisco NX-OS Message Transfer Service Denial of Service Vulnerability  CVE-2014-2201 No Officially Released Versions are Affected
  Recommended Release	2.2(1d)	2.2(1d)	N/A	6.2(8)	N/A	5.2(1)N1(7) 6.0(2)N2(4) 7.0(2)N1(1)	4.1(2)E1(11)	5.0(3)U5(1) 6.0(2)U2(4)	N/A	N/A	CG4(3) 15.4(1)CG

  
  Legend:

  UCS 6100 = Cisco Unified Computing Server Fabric Interconnect 6100 Series devices
  UCS 6200 = Cisco Unified Computing Server Fabric Interconnect 6200 Series devices
  Nexus 9000 = Cisco Nexus 9000 Series devices
  Nexus 7000 = Cisco Nexus 7000 Series devices
  Nexus 6000 = Cisco Nexus 6000 Series devices
  Nexus 5000 = Cisco Nexus 5000 Series and Cisco Nexus 5500 Series devices
  Nexus 4000 = Cisco Nexus 4000 Series blade devices
  Nexus 3000 = Cisco Nexus 3000 and Cisco Nexus 3500 Series devices
  Nexus 1000V = Cisco Nexus 1000V Series Switches and 1010 Virtual Services Appliances
  MDS 9000 = Cisco MDS 9000 Multilayer Switch/Director Family devices
  CGR 1000 = Cisco 1000 Series Connected Grid Router devices

  Note: The recommended software releases above resolve all issues impacting each platform in the preceding table.

  Products Confirmed Not Vulnerable

  • Cisco Nexus 9000 Series
  • Cisco Nexus 7700 Series
  • Cisco Nexus 6000 Series
  • Cisco Nexus 5600 Series
  • Cisco Nexus 2000 Series
  • Cisco Nexus 1000V Series
  • Cisco Nexus 1010 Series Application Services Platforms
  • Cisco Nexus 1100 Series Cloud Services Platforms
  • Cisco MDS 9000 Multilayer Switch/Director Family devices 

  No other Cisco products are currently known to be affected by these vulnerabilities.

Details

• Cisco NX-OS Virtual Device Context SSH Privilege Escalation Vulnerability

  Cisco NX-OS-Based devices contain a privilege escalation vulnerability when multiple virtual device contexts (VDC) exist on the system and local authentication has been configured. A remote, authenticated attacker that can access the management interfaces via SSH of an affected device could authenticate in such a way as to obtain the privileges of an administrator in another VDC. Under certain conditions this may allow an attacker to take complete control of the affected device.
  
  This vulnerability is documented in Cisco bug ID CSCti11629 (registered customers only) and has been assigned the following Common Vulnerabilities and Exposures (CVE) ID CVE-2014-2200.
  

  Cisco NX-OS Virtual Device Context SSH Key Privilege Escalation Vulnerability

  Cisco NX-OS-Based devices contain a privilege escalation vulnerability when multiple virtual device contexts (VDCs) exist on the system and local authentication has been configured. A remote, authenticated attacker who can access the SSH management interfaces of an affected device could manipulate the login information supplied as part of the SSH key file to exploit the vulnerability. This could allow the attacker to obtain the privileges of an administrator in another VDC. Under certain conditions, this may allow the attacker to take complete control of the affected device.
  
  This vulnerability is documented in Cisco bug ID CSCud88400 (registered customers only) and has been assigned CVE ID CVE-2013-1191.
  

  Cisco NX-OS-Based Products Smart Call Home Buffer Overflow Vulnerability

  Cisco NX-OS-Based products that support the Smart Call Home feature set are affected by a buffer overflow vulnerability. An unauthenticated, remote attacker who can obtain control of a configured SMTP server could trigger a buffer overflow condition. Successful exploitation could allow the attacker to execute arbitrary code with elevated privileges on the affected device.
  
  This vulnerability is due to a failure to properly sanitize input received from remote hosts while sending a Smart Call Home notification.
  
  Devices running an affected version of software contain the vulnerability, these devices are only at risk if they have configured Smart Call Home to utilize SMTP reporting.
  
  This vulnerability is documented in the following Cisco bug IDs:

  • Cisco Unified Computing System Fabric Interconnects - CSCtk00695 (registered customers only)
  • Nexus 3000 - CSCts56633 (registered customers only)
  • Nexus 5000 - CSCts56632 (registered customers only)
  • Nexus 7000 - CSCts56628 (registered customers only)
  • Nexus 4000 - CSCug14405 (registered customers only)
  • Cisco Connected 1000 Series Connected Grid Routers running CG-OS - CSCuf61322 (registered customers only)

  The vulnerability has been assigned CVE ID CVE-2014-3261.
  

  Cisco NX-OS Message Transfer Service Denial of Service Vulnerability

  Further engineering efforts have determined that no officially released images are affected by this vulnerability. Customers running a pre-release version of NX-OS 6.0 may be affected and are advised to update to an official release.
  
   A vulnerability in the Message Transfer Service (MTS) of version 6.0(1) of Cisco NX-OS could allow an unauthenticated, remote attacker to trigger a denial of service (DoS) condition.
  
  The vulnerability is due to a NULL pointer dereference that may occur when an affected device is under a heavy load. An attacker could exploit this vulnerability by sending a significant amount of specially designed traffic to trigger the condition. An exploit could allow the attacker to cause a kernel panic, resulting in a DoS condition.
  
  This vulnerability is documented in Cisco bug ID CSCtw98915 (registered customers only) and has been assigned CVE ID CVE-2014-2201.

Workarounds

• No workarounds are available.

Fixed Software

• When considering software upgrades, customers are advised to consult the Cisco Security Advisories, Responses, and Notices archive at http://www.cisco.com/go/psirt and review subsequent advisories to determine exposure and a complete upgrade solution.
  
  In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.
  
  Cisco Unified Computing System:
  Cisco NX-OS-Based Products Smart Call Home Buffer Overflow Vulnerability
  
  

  Affected Version	First Fixed Release	Recommended Release
  1.0	N/A	2.2(1d)
  1.1	N/A	2.2(1d)
  1.2	N/A	2.2(1d)
  1.3	N/A	2.2(1d)
  1.4(1h) and prior	1.4(1i)	2.2(1d)

  
  
  Cisco Nexus 7000:
  Cisco NX-OS Virtual Device Context SSH Privilege Escalation Vulnerability
  
  

  Affected Version	First Fixed Release>	Recommended Release
  4.X	N/A	6.2(8)
  5.0(2a) and prior	5.0(5)	6.2(8)

  
  Cisco NX-OS Virtual Device Context SSH Key Privilege Escalation Vulnerability
  
  

  Affected Version	First Fixed Release	Recommended Release
  4.X	N/A	6.2(8)
  5.X	N/A	6.2(8)
  6.0	N/A	6.2(8)
  6.1(4a) and prior	6.1(5)	6.2(8)

  
  Cisco NX-OS-Based Products Smart Call Home Buffer Overflow Vulnerability
  
  

  Affected Version	First Fixed Release	Recommended Release
  4.X	N/A	6.2(8)
  5.0	N/A	6.2(8)
  5.1	N/A	6.2(8)
  5.2(3) and prior	5.2(3a)	6.2(8)

  
  
  Cisco Nexus 5000:
  Cisco NX-OS-Based Products Smart Call Home Buffer Overflow Vulnerability
  
  

  Affected Version	First Fixed Release	Recommended Release
  4.X	N/A	5.2(1)N1(7)  6.0(2)N2(4)  7.0(2)N1(1)
  5.0	5.1(3)N1(1)	5.2(1)N1(7)  6.0(2)N2(4)  7.0(2)N1(1)

  
  Cisco Nexus 4000:
  Cisco NX-OS-Based Products Smart Call Home Buffer Overflow Vulnerability
  
  

  Affected Version	First Fixed Release	Recommended Release
  4.1(2)E1(1k) and prior	4.1(2)E1(1l)	4.1(2)E1(1l)

  
  Cisco Nexus 3000:
  Cisco NX-OS-Based Products Smart Call Home Buffer Overflow Vulnerability
  
  

  Affected Version	First Fixed Release	Recommended Release
  5.0(3)U2(1) and prior	5.0(3)U2(2)	5.0(3)U5(1j)  6.0(2)U2(4)

  
  Cisco 1000 Series Connected Grid Router:
  Cisco NX-OS-Based Products Smart Call Home Buffer Overflow Vulnerability
  
  

  Affected Version	First Fixed Release	Recommended Release
  CG3	N/A	CG4(3)  15.4(1)CG
  CG4(1)	CG4(2)	CG4(3)  15.4(1)CG

Exploitation and Public Announcements

• The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.
  
  These vulnerabilities were discovered during internal testing and during the investigation of customer cases by the Cisco TAC.

URL

• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140521-nxos

Revision History

• Revision 2.3	2014-June-02	Updated Recommended Version in Nexus 7000 Software tables for the Cisco NX-OS Virtual Device Context SSH Privilege Escalation Vulnerability to match other tables.
  Revision 2.2	2014-May-29	Removed Nexus 5500UP devices from the Confirmed Not Vulnerable section. While these devices shipped with a non-vulnerable version of NX-OS, they are capable of running an affected version of 5.0(3).
  Revision 2.1	2014-May-28	Added a clarifying statement to the Smart Call Home vulnerability to stipulate that SCH must be configured to utilize SMTP as the reporting method.
  Revision 2.0	2014-May-28	Further engineering efforts have determined that no officially released images are affected by the Message Transfer Service Denial of Service vulnerability. Customers running a pre-release version of NX-OS 6.0 may be affected and are advised to update to an official release. MDS 9000 Family moved to Products Confirmed Not Vulnerable.
  Revision 1.1	2014-May-21	Updated tables for legibility purposes.
  Revision 1.0	2014-May-21	Initial public release.

  Show Less