1. 主页
  2. 保安警报
  3. 保安警报 (A16-10-01)

保安警报(A16-10-01): Cisco产品多个漏洞


 

发布日期: 2016年 10月 1日

  
  

描述:

Cisco 发布了五个安全公告，以应对发现于 Cisco NX-OS软件中的漏洞。远程攻击者可向受影响装置发送含特制恶意内容的BGP更新讯息、DHCPv4或OTV UDP封包来攻击这个漏洞。

 

受影响的系统:

  • Multilayer Director Switches
  • Nexus 1000V Series Switches
  • Nexus 2000 Series Fabric Extenders
  • Nexus 3000 Series Switches
  • Nexus 3500 Platform Switches
  • Nexus 4000 Series Switches
  • Nexus 5000 Series Switches
  • Nexus 5500 Platform Switches
  • Nexus 5600 Platform Switches
  • Nexus 6000 Series Switches
  • Nexus 7000 Series Switches
  • Nexus 7700 Series Switches
  • Nexus 9000 Series Switches (in ACI mode or NX-OS mode)

关于受影响产品的详细数据，请参阅供货商网站相关安全公告中 “Affected Products” 的部分:

1. Cisco NX-OS 软件产品认证、授权和计帐绕过漏洞
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-nxaaa

2. Cisco Nexus 7000 和 7700 系列交换器覆盖传输虚拟化缓冲区溢出漏洞
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-otv

3. Cisco NX-OS边界网关协议服务受阻断漏洞
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-bgp

4. Cisco NX-OS 软件特制DHCPv4封包拒绝服务漏洞
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-dhcp1

5. Cisco NX-OS 软件异常DHCPv4封包拒绝服务漏洞
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-dhcp2

 

影响:

成功利用这些漏洞可以导致执行任意程序代码、绕过保安限制、服务受阻断或重新启动装置，视乎攻击者利用哪个漏洞而定。

 

建议:

适用于受影响系统的修补程序已可获取。受影响系统的用户应遵从产品供货商的建议，立即采取行动以降低风险。有关修补程序的详细数据，请参阅供货商网站的相应安全公告中有关 “Fixed Software” 的部分。

 

进一步信息:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-bgp
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-dhcp1
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-dhcp2
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-nxaaa
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161005-otv
https://www.us-cert.gov/ncas/current-activity/2016/10/05/Cisco-Releases-Security-Updates
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0721
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1453
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1454
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6392
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6393 



标签 : Cisco , Cisco NX-OS
标签