National Vulnerability Database

National Vulnerability Database

National Vulnerability
Database

CVE-2019-1599 Detail

Current Description

A vulnerability in the network stack of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on the affected device. The vulnerability is due to an issue with allocating and freeing memory buffers in the network stack. An attacker could exploit this vulnerability by sending crafted TCP streams to an affected device in a sustained way. A successful exploit could cause the network stack of an affected device to run out of available buffers, impairing operations of control plane and management plane protocols, resulting in a DoS condition. Note: This vulnerability can be triggered only by traffic that is destined to an affected device and cannot be exploited using traffic that transits an affected device. Nexus 1000V Switch for Microsoft Hyper-V is affected in versions prior to 5.2(1)SM3(2.1). Nexus 1000V Switch for VMware vSphere is affected in versions prior to 5.2(1)SV3(4.1a). Nexus 3000 Series Switches are affected in versions prior to 7.0(3)I7(6) and 9.2(2). Nexus 3500 Platform Switches are affected in versions prior to 6.0(2)A8(11), 7.0(3)I7(6), and 9.2(2). Nexus 3600 Platform Switches are affected in versions prior to 7.0(3)F3(5) and 9.2(2). Nexus 5500, 5600, and 6000 Series Switches are affected in versions prior to 7.1(5)N1(1b) and 7.3(5)N1(1). Nexus 7000 and 7700 Series Switches are affected in versions prior to 6.2(22. Nexus 9500 R-Series Line Cards and Fabric Modules are affected in versions prior to 7.0(3)F3(5) and 9.2(2). UCS 6200 and 6300 Series Fabric Interconnect are affected in versions prior to 3.2(3j) and 4.0(2a). UCS 6400 Series Fabric Interconnect are affected in versions prior to 4.0(2a).

Source:  MITRE
Description Last Modified:  03/07/2019
View Analysis Description

Impact

CVSS v3.0 Severity and Metrics:

Base Score: 8.6 HIGH
Vector: AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H (V3 legend)
Impact Score: 4.0
Exploitability Score: 3.9


Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope (S): Changed
Confidentiality (C): None
Integrity (I): None
Availability (A): High

CVSS v2.0 Severity and Metrics:

Base Score: 7.8 HIGH
Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:C) (V2 legend)
Impact Subscore: 6.9
Exploitability Subscore: 10.0


Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (AU): None
Confidentiality (C): None
Integrity (I): None
Availability (A): Complete
Additional Information:
Allows disruption of service

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink Resource
http://www.securityfocus.com/bid/107342 Third Party Advisory VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-nxos-netstack Patch Vendor Advisory

Technical Details

Vulnerability Type (View All)

  • Resource Management Errors (CWE-399)

Vulnerable software and versions Switch to CPE 2.2

Configuration 1
AND
OR
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*    versions from (including) 9.2 up to (excluding) 9.2\(2\)
OR
cpe:2.3:h:cisco:nexus_3000:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_3500:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_3600:-:*:*:*:*:*:*:*
Configuration 2
AND
OR
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*    versions from (including) 7.0\(3\) up to (excluding) 7.0\(3\)i7\(5\)
OR
cpe:2.3:h:cisco:nexus_3500:-:*:*:*:*:*:*:*
Configuration 3
AND
OR
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*    versions from (including) 7.0\(3\) up to (excluding) 7.0\(3\)f3\(5\)
OR
cpe:2.3:h:cisco:nexus_3600:-:*:*:*:*:*:*:*
Configuration 4
AND
OR
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*    versions from (including) 7.2 up to (excluding) 7.3\(5\)n1\(1\)
OR
cpe:2.3:h:cisco:nexus_5500:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_5600:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_6000:-:*:*:*:*:*:*:*
Configuration 5
AND
OR
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*    versions from (including) 8.3 up to (excluding) 8.3\(2\)
OR
cpe:2.3:h:cisco:nexus_7000:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_7700:-:*:*:*:*:*:*:*
Configuration 6
AND
OR
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*    versions from (including) 9.2 up to (excluding) 9.2\(2\)
OR
cpe:2.3:h:cisco:nexus_9000:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_9500:-:*:*:*:*:*:*:*
Configuration 7
AND
OR
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*    versions up to (excluding) 6.0\(2\)a8\(11\)
OR
cpe:2.3:h:cisco:nexus_3500:-:*:*:*:*:*:*:*
Configuration 8
AND
OR
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*    versions up to (excluding) 6.2\(22\)
OR
cpe:2.3:h:cisco:nexus_7000:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_7700:-:*:*:*:*:*:*:*
Configuration 9
AND
OR
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*    versions from (including) 7.0\(3\)i5 up to (excluding) 7.0\(3\)i7\(6\)
OR
cpe:2.3:h:cisco:nexus_3000:-:*:*:*:*:*:*:*
Configuration 10
AND
OR
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*    versions from (including) 7.0\(3\) up to (excluding) 7.0\(3\)f3\(5\)
OR
cpe:2.3:h:cisco:nexus_9500:-:*:*:*:*:*:*:*
Configuration 11
AND
OR
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*    versions up to (excluding) 5.2\(1\)sm3\(2.1\)
OR
cpe:2.3:h:cisco:nexus_1000v:-:*:*:*:*:microsoft_hyper-v:*:*
Configuration 12
AND
OR
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*    versions up to (excluding) 5.2\(1\)sv3\(4.1a\)
OR
cpe:2.3:h:cisco:nexus_1000v:-:*:*:*:*:vmware_vsphere:*:*
Configuration 13
AND
OR
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*    versions from (including) 4.0 up to (excluding) 4.0\(2a\)
OR
cpe:2.3:h:cisco:ucs_6200:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ucs_6300:-:*:*:*:*:*:*:*
Configuration 14
AND
OR
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*    versions from (including) 4.0 up to (excluding) 4.0\(2a\)
OR
cpe:2.3:h:cisco:ucs_6400:-:*:*:*:*:*:*:*
Configuration 15
AND
OR
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*    versions up to (excluding) 3.2\(3j\)
OR
cpe:2.3:h:cisco:ucs_6200:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:ucs_6300:-:*:*:*:*:*:*:*
Configuration 16
AND
OR
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*    versions up to (excluding) 7.0\(3\)i4\(9\)
OR
cpe:2.3:h:cisco:nexus_3000:-:*:*:*:*:*:*:*
Configuration 17
AND
OR
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*    versions up to (excluding) 7.1\(5\)n1\(1b\)
OR
cpe:2.3:h:cisco:nexus_5500:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_5600:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_6000:-:*:*:*:*:*:*:*
Configuration 18
AND
OR
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*    versions from (including) 8.0 up to (excluding) 8.2\(3\)
OR
cpe:2.3:h:cisco:nexus_7000:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_7700:-:*:*:*:*:*:*:*
Configuration 19
AND
OR
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*    versions from (including) 7.2 up to (excluding) 7.3\(3\)d1\(1\)
OR
cpe:2.3:h:cisco:nexus_7000:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_7700:-:*:*:*:*:*:*:*
Configuration 20
AND
OR
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*    versions from (including) 7.0\(3\)i5 up to (excluding) 7.0\(3\)i7\(6\)
OR
cpe:2.3:h:cisco:nexus_9000:-:*:*:*:*:*:*:*
Configuration 21
AND
OR
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*    versions up to (excluding) 7.0\(3\)i4\(9\)
OR
cpe:2.3:h:cisco:nexus_9000:-:*:*:*:*:*:*:*

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

2 change records found - show changes

Quick Info

CVE Dictionary Entry:
CVE-2019-1599
NVD Published Date:
03/07/2019
NVD Last Modified:
03/14/2019