Vulnerabilities > CVE-2011-0355 - Resource Management Errors vulnerability in multiple products

047910
CVSS 7.8 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
COMPLETE
network
low complexity
cisco
vmware
CWE-399
nessus
NVD
Published: 2011-02-17
Updated: 2018-10-10

Summary

Cisco Nexus 1000V Virtual Ethernet Module (VEM) 4.0(4) SV1(1) through SV1(3b), as used in VMware ESX 4.0 and 4.1 and ESXi 4.0 and 4.1, does not properly handle dropped packets, which allows guest OS users to cause a denial of service (ESX or ESXi host OS crash) by sending an 802.1Q tagged packet over an access vEthernet port, aka Cisco Bug ID CSCtj17451.

Vulnerable Configurations

Part Description Count
Application
Cisco
5
Application
Vmware
4

Common Weakness Enumeration (CWE)

Nessus

NASL familyCISCO
NASL idCISCO-CSCTJ17451-NXOS.NASL
descriptionThe remote Cisco Nexus device is affected by a denial of service condition when processing 802.1Q tagged packets.
last seen2020-06-01
modified2020-06-02
plugin id69481
published2013-08-13
reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
sourcehttps://www.tenable.com/plugins/nessus/69481
titleCisco Nexus 1000V VEM DoS (CSCtj17451)
code
#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(69481);
  script_version("1.9");
  script_cvs_date("Date: 2019/10/29 10:38:39");

  script_cve_id("CVE-2011-0355");
  script_bugtraq_id(46247);
  script_xref(name:"CISCO-BUG-ID", value:"CSCtj17451");

  script_name(english:"Cisco Nexus 1000V VEM DoS (CSCtj17451)");
  script_summary(english:"Checks the NX-OS version.");

  script_set_attribute(attribute:"synopsis", value:"The remote device is missing a vendor-supplied security update.");
  script_set_attribute(attribute:"description", value:
"The remote Cisco Nexus device is affected by a denial of service
condition when processing 802.1Q tagged packets.");
  # https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus1000/sw/4_0_4_s_v_1_3_c/release/notes/n1000v_rn.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?71ec326e");
  # https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus1000/sw/4_2_1_s_v_1_4/release/notes/n1000v_rn.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ac81edc6");
  script_set_attribute(attribute:"solution", value:"Upgrade to version 4.0(4)SV1(3c) or 4.2(1)SV1(4).");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nx-os");

  script_set_attribute(attribute:"vuln_publication_date", value:"2011/02/04");
  script_set_attribute(attribute:"patch_publication_date", value:"2011/02/04");
  script_set_attribute(attribute:"plugin_publication_date", value:"2013/08/13");

  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"CISCO");

  script_dependencies("cisco_nxos_version.nasl");
  script_require_keys("Host/Cisco/NX-OS/Version", "Host/Cisco/NX-OS/Model", "Host/Cisco/NX-OS/Device");

  exit(0);
}

include("audit.inc");
include("cisco_func.inc");

device = get_kb_item_or_exit("Host/Cisco/NX-OS/Device");
model = get_kb_item_or_exit("Host/Cisco/NX-OS/Model");
version = get_kb_item_or_exit("Host/Cisco/NX-OS/Version");

# only affects Nexus 1000V systems
if (device != 'Nexus' || model !~ '^1000[Vv]$') audit(AUDIT_HOST_NOT, "affected");

flag = 0;

if (
 version == "4.0(4)SV1(3b)" ||
 version == "4.0(4)SV1(3a)" ||
 version == "4.0(4)SV1(3)" ||
 version == "4.0(4)SV1(2)" ||
 version == "4.0(4)SV1(1)"
) flag++;

if (flag)
{
  if (report_verbosity > 0)
  {
    report =
      '\n  Model             : ' + device + ' ' + model +
      '\n  Installed version : ' + version +
      '\n  Fixed version     : 4.0(4)SV1(3c) / 4.2(1)SV1(4)' + 
      '\n';
    security_hole(port:0, extra:report);
  }
  else security_hole(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");

References