CVE-2013-6982: Input Validation

Q: What is the severity of CVE-2013-6982?

CVE-2013-6982 is classified as a high severity vulnerability due to its potential to cause a denial of service.

Q: How do I fix CVE-2013-6982?

To fix CVE-2013-6982, update your Cisco NX-OS to the latest version that addresses this vulnerability.

Q: What versions of Cisco NX-OS are affected by CVE-2013-6982?

The affected versions include Cisco NX-OS 6.2(2a) and earlier releases.

Q: What kind of attack does CVE-2013-6982 allow?

CVE-2013-6982 allows remote attackers to execute a denial-of-service attack through crafted BGP UPDATE messages.

Q: Is there a workaround for CVE-2013-6982?

There are no known effective workarounds for CVE-2013-6982, so the recommendation is to apply the patch.

Published Jan 8, 2014

Updated

The BGP implementation in Cisco NX-OS 6.2(2a) and earlier does not properly handle the interaction of UPDATE messages with IPv6, VPNv4, and VPNv6 labeled unicast-address families, which allows remote attackers to cause a denial of service (peer reset) via a crafted message, aka Bug ID CSCuj03174.

Affected Software

101 affected components

Cisco NX-OS<=6.2\(2a\)

Cisco NX-OS

Cisco NX-OS=4.0

Cisco NX-OS=4.0\(0\)n1\(1a\)

Cisco NX-OS=4.0\(0\)n1\(2\)

Cisco NX-OS=4.0\(0\)n1\(2a\)

Cisco NX-OS=4.0\(1a\)n1\(1\)

Cisco NX-OS=4.0\(1a\)n1\(1a\)

Cisco NX-OS=4.0\(1a\)n2\(1\)

Cisco NX-OS=4.0\(1a\)n2\(1a\)

Cisco NX-OS=4.0\(4\)sv1\(1\)

Cisco NX-OS=4.0\(4\)sv1\(2\)

Cisco NX-OS=4.0\(4\)sv1\(3\)

Cisco NX-OS=4.0\(4\)sv1\(3a\)

Cisco NX-OS=4.0\(4\)sv1\(3b\)

Cisco NX-OS=4.0\(4\)sv1\(3c\)

Cisco NX-OS=4.0\(4\)sv1\(3d\)

Cisco NX-OS=4.1\(3\)n1\(1\)

Cisco NX-OS=4.1\(3\)n1\(1a\)

Cisco NX-OS=4.1\(3\)n2\(1\)

Cisco NX-OS=4.1\(3\)n2\(1a\)

Cisco NX-OS=4.1.\(2\)

Cisco NX-OS=4.1.\(3\)

Cisco NX-OS=4.1.\(4\)

Cisco NX-OS=4.1.\(5\)

Cisco NX-OS=4.2

Cisco NX-OS=4.2\(1\)

Cisco NX-OS=4.2\(1\)n1\(1\)

Cisco NX-OS=4.2\(1\)n2\(1\)

Cisco NX-OS=4.2\(1\)n2\(1a\)

Cisco NX-OS=4.2\(1\)sv1\(4\)

Cisco NX-OS=4.2\(1\)sv1\(4a\)

Cisco NX-OS=4.2\(1\)sv1\(5.1\)

Cisco NX-OS=4.2\(2\)

Cisco NX-OS=4.2\(3\)

Cisco NX-OS=4.2\(4\)

Cisco NX-OS=4.2\(6\)

Cisco NX-OS=4.2\(8\)

Cisco NX-OS=4.2.\(2a\)

Cisco NX-OS=5.0

Cisco NX-OS=5.0\(2\)

Cisco NX-OS=5.0\(2\)n1\(1\)

Cisco NX-OS=5.0\(2\)n2\(1\)

Cisco NX-OS=5.0\(2\)n2\(1a\)

Cisco NX-OS=5.0\(2a\)

Cisco NX-OS=5.0\(3\)

Cisco NX-OS=5.0\(3\)n1\(1\)

Cisco NX-OS=5.0\(3\)n1\(1a\)

Cisco NX-OS=5.0\(3\)n1\(1b\)

Cisco NX-OS=5.0\(3\)n1\(1c\)

Cisco NX-OS=5.0\(3\)n2\(1\)

Cisco NX-OS=5.0\(3\)n2\(2\)

Cisco NX-OS=5.0\(3\)n2\(2a\)

Cisco NX-OS=5.0\(3\)n2\(2b\)

Cisco NX-OS=5.0\(3\)u1\(1a\)

Cisco NX-OS=5.0\(3\)u1\(1b\)

Cisco NX-OS=5.0\(3\)u1\(1d\)

Cisco NX-OS=5.0\(3\)u1\(2\)

Cisco NX-OS=5.0\(3\)u1\(2a\)

Cisco NX-OS=5.0\(3\)u2\(1\)

Cisco NX-OS=5.0\(3\)u2\(2\)

Cisco NX-OS=5.0\(3\)u2\(2a\)

Cisco NX-OS=5.0\(3\)u2\(2b\)

Cisco NX-OS=5.0\(3\)u2\(2c\)

Cisco NX-OS=5.0\(3\)u2\(2d\)

Cisco NX-OS=5.0\(3\)u3\(1\)

Cisco NX-OS=5.0\(3\)u3\(2\)

Cisco NX-OS=5.0\(3\)u3\(2a\)

Cisco NX-OS=5.0\(3\)u3\(2b\)

Cisco NX-OS=5.0\(3\)u4\(1\)

Cisco NX-OS=5.0\(3\)u5\(1\)

Cisco NX-OS=5.0\(3\)u5\(1a\)

Cisco NX-OS=5.0\(3\)u5\(1b\)

Cisco NX-OS=5.0\(3\)u5\(1c\)

Cisco NX-OS=5.0\(3\)u5\(1d\)

Cisco NX-OS=5.0\(3\)u5\(1e\)

Cisco NX-OS=5.0\(5\)

Cisco NX-OS=5.1

Cisco NX-OS=5.1\(1\)

Cisco NX-OS=5.1\(1a\)

Cisco NX-OS=5.1\(2\)

Cisco NX-OS=5.1\(3\)

Cisco NX-OS=5.1\(3\)n1\(1\)

Cisco NX-OS=5.1\(3\)n1\(1a\)

Cisco NX-OS=5.1\(4\)

Cisco NX-OS=5.1\(5\)

Cisco NX-OS=5.1\(6\)

Cisco NX-OS=5.2

Cisco NX-OS=5.2\(1\)

Cisco NX-OS=5.2\(3\)

Cisco NX-OS=5.2\(3a\)

Cisco NX-OS=5.2\(4\)

Cisco NX-OS=5.2\(5\)

Cisco NX-OS=5.2\(7\)

Cisco NX-OS=5.2\(9\)

Cisco NX-OS=6.0\(1\)

Cisco NX-OS=6.0\(2\)

Cisco NX-OS=6.1

Cisco NX-OS=6.1\(1\)

Cisco NX-OS=6.1\(2\)

Cisco NX-OS=6.1\(3\)

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Cisco NX-OS to a version that resolves this vulnerability.
Fixed in 6.2(2a)Patch Bug ID CSCuj03174

Event History

Jan 8, 2014

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Data Sourced

via NVD·09:55 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2013-6982?

CVE-2013-6982 is classified as a high severity vulnerability due to its potential to cause a denial of service.

How do I fix CVE-2013-6982?