CVE-2017-12342

A vulnerability in the Open Agent Container (OAC) feature of Cisco Nexus Series Switches could allow an unauthenticated, local attacker to read and send packets outside the scope of the OAC. The vulnerability is due to insufficient internal security measures in the OAC feature. An attacker could exploit this vulnerability by crafting specific packets for communication on the device-internal network. A successful exploit could allow the attacker to run code on the underlying host operating system. OAC is not enabled by default. For a device to be vulnerable, an administrator would need to install and activate this feature. This vulnerability affects the following Cisco Nexus Series Switches: Nexus 2000 Series Fabric Extenders, Nexus 5000 Series Switches, Nexus 5500 Platform Switches, Nexus 5600 Platform Switches, Nexus 6000 Series Switches, Nexus 7000 Series Switches, Nexus 7700 Series Switches. Cisco Bug IDs: CSCve53542, CSCvf36621.

CVSS v3 6.8 MEDIUM
CVSS v2.0 4.6 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector : AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Exploitability : 2.5 / Impact : 3.7

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

4.6^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 3.9 / Impact : 6.4

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.securityfocus.com/bid/102027	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1039940	Third Party Advisory VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171129-nxos9	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:cisco:nx-os:7.0\(0\)hsk\(0.357\):::::::*
	cpe:2.3:o:cisco:nx-os:8.1\(1\):::::::*

History

No history.

Information

Published : 2017-11-30 09:29

Updated : 2023-12-10 12:15

NVD link : CVE-2017-12342

Mitre link : CVE-2017-12342

CVE.ORG link : CVE-2017-12342

JSON object : View

Products Affected

cisco

nx-os

CWE

CWE-668

Exposure of Resource to Wrong Sphere

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2017-12342", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.6, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 6.8, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 2.5}]}, "published": "2017-11-30T09:29:00.713", "references": [{"url": "http://www.securityfocus.com/bid/102027", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securitytracker.com/id/1039940", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171129-nxos9", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-668"}]}, {"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the Open Agent Container (OAC) feature of Cisco Nexus Series Switches could allow an unauthenticated, local attacker to read and send packets outside the scope of the OAC. The vulnerability is due to insufficient internal security measures in the OAC feature. An attacker could exploit this vulnerability by crafting specific packets for communication on the device-internal network. A successful exploit could allow the attacker to run code on the underlying host operating system. OAC is not enabled by default. For a device to be vulnerable, an administrator would need to install and activate this feature. This vulnerability affects the following Cisco Nexus Series Switches: Nexus 2000 Series Fabric Extenders, Nexus 5000 Series Switches, Nexus 5500 Platform Switches, Nexus 5600 Platform Switches, Nexus 6000 Series Switches, Nexus 7000 Series Switches, Nexus 7700 Series Switches. Cisco Bug IDs: CSCve53542, CSCvf36621."}, {"lang": "es", "value": "Una vulnerabilidad en la caracter\u00edstica OAC (Open Agent Container) de Cisco Nexus Series Switches podr\u00eda permitir que un atacante local no autenticado lea y env\u00ede paquetes fuera del alcance del OAC. La vulnerabilidad se debe a las medidas insuficientes de seguridad interna en la caracter\u00edstica OAC. Un atacante podr\u00eda explotar esta vulnerabilidad manipulando paquetes espec\u00edficos para la comunicaci\u00f3n en la red interna del dispositivo. Una explotaci\u00f3n exitosa podr\u00eda permitir que un atacante ejecute c\u00f3digo en el sistema operativo del host subyacente. OAC no est\u00e1 habilitado por defecto. Para que un dispositivo sea vulnerable, un administrador necesitar\u00eda instalar y activar esta caracter\u00edstica. Esta vulnerabilidad afecta a los siguientes productos Cisco Nexus Series Switches: Nexus 2000 Series Fabric Extenders, Nexus 5000 Series Switches, Nexus 5500 Platform Switches, Nexus 5600 Platform Switches, Nexus 6000 Series Switches, Nexus 7000 Series Switches y Nexus 7700 Series Switches. Cisco Bug IDs: CSCve53542, CSCvf36621."}], "lastModified": "2019-10-09T23:22:58.763", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cisco:nx-os:7.0\\(0\\)hsk\\(0.357\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EE7BCA11-7B09-43A3-A589-59D48402F564"}, {"criteria": "cpe:2.3:o:cisco:nx-os:8.1\\(1\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AB556839-151C-492E-B4C3-C024276D5AB1"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}