Cisco Nexus 3600 External BGP DoS (cisco-sa-nxos-po-acl-TkyePgvL)

high Nessus Plugin ID 191465

Language:

Synopsis

The remote device is missing a vendor-supplied security patch

Description

A vulnerability in the External Border Gateway Protocol (eBGP) implementation of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.

This vulnerability exists because eBGP traffic is mapped to a shared hardware rate-limiter queue. An attacker could exploit this vulnerability by sending large amounts of network traffic with certain characteristics through an affected device. A successful exploit could allow the attacker to cause eBGP neighbor sessions to be dropped, leading to a DoS condition in the network.

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

Solution

Upgrade to the relevant fixed version referenced in Cisco bug IDs CSCwh09703, CSCwh96478

Plugin Details

Severity: High

ID: 191465

File Name: cisco-sa-nxos-ebgp-dos-L3QCwVJ.nasl

Version: 1.0

Type: combined

Family: CISCO

Published: 3/1/2024

Updated: 3/1/2024

Configuration: Enable paranoid mode

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.4

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2024-20321

CVSS v3

Risk Factor: High

Base Score: 8.6

Temporal Score: 7.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:cisco:nx-os

Required KB Items: Host/Cisco/NX-OS/Version, Host/Cisco/NX-OS/Model, Host/Cisco/NX-OS/Device, Settings/ParanoidReport

Exploit Ease: No known exploits are available

Patch Publication Date: 2/28/2024

Vulnerability Publication Date: 2/28/2024

Reference Information

CVE: CVE-2024-20321

CWE: 400

CISCO-SA: cisco-sa-nxos-ebgp-dos-L3QCwVJ

IAVA: 2024-A-0119

CISCO-BUG-ID: CSCwh09703, CSCwh96478

Detections

Analytics