CVE-2014-2200: High severity Cisco NX-OS vulnerability

Published May 24, 2014

Updated

Cisco NX-OS 5.0 before 5.0(5) on Nexus 7000 devices, when local authentication and multiple VDCs are enabled, allows remote authenticated users to gain privileges within an unintended VDC via an SSH session to a management interface, aka Bug ID CSCti11629.

Affected Software

68 affected components

Cisco NX-OS=5.0\(3\)n1\(1\)

Cisco NX-OS=5.0\(3\)n1\(1a\)

Cisco NX-OS=5.0\(3\)n1\(1b\)

Cisco NX-OS=5.0\(3\)n1\(1c\)

Cisco NX-OS=5.0\(3\)n2\(1\)

Cisco NX-OS=5.0\(3\)n2\(2\)

Cisco NX-OS=5.0\(3\)n2\(2a\)

Cisco NX-OS=5.0\(3\)n2\(2b\)

Cisco NX-OS=5.0\(3\)u1\(1a\)

Cisco NX-OS=5.0\(3\)u1\(1b\)

Cisco NX-OS=5.0\(3\)u1\(1d\)

Cisco NX-OS=5.0\(3\)u1\(2\)

Cisco NX-OS=5.0\(3\)u1\(2a\)

Cisco NX-OS=5.0\(3\)u2\(1\)

Cisco NX-OS=5.0\(3\)u2\(2\)

Cisco NX-OS=5.0\(3\)u2\(2a\)

Cisco NX-OS=5.0\(3\)u2\(2b\)

Cisco NX-OS=5.0\(3\)u2\(2c\)

Cisco NX-OS=5.0\(3\)u2\(2d\)

Cisco NX-OS=5.0\(3\)u3\(1\)

Cisco NX-OS=5.0\(3\)u3\(2\)

Cisco NX-OS=5.0\(3\)u3\(2a\)

Cisco NX-OS=5.0\(3\)u3\(2b\)

Cisco NX-OS=5.0\(3\)u4\(1\)

Cisco NX-OS=5.0\(3\)u5\(1\)

Cisco NX-OS=5.0\(3\)u5\(1a\)

Cisco NX-OS=5.0\(3\)u5\(1b\)

Cisco NX-OS=5.0\(3\)u5\(1c\)

Cisco NX-OS=5.0\(3\)u5\(1d\)

Cisco NX-OS=5.0\(3\)u5\(1e\)

Cisco Nexus 7000

Cisco Nexus 7000 10-slot

Cisco Nexus 7000 18-slot

Cisco Nexus 7000 9-slot

All of the following

Any of the following

Cisco NX-OS=5.0\(3\)n1\(1\)

Cisco NX-OS=5.0\(3\)n1\(1a\)

Cisco NX-OS=5.0\(3\)n1\(1b\)

Cisco NX-OS=5.0\(3\)n1\(1c\)

Cisco NX-OS=5.0\(3\)n2\(1\)

Cisco NX-OS=5.0\(3\)n2\(2\)

Cisco NX-OS=5.0\(3\)n2\(2a\)

Cisco NX-OS=5.0\(3\)n2\(2b\)

Cisco NX-OS=5.0\(3\)u1\(1a\)

Cisco NX-OS=5.0\(3\)u1\(1b\)

Cisco NX-OS=5.0\(3\)u1\(1d\)

Cisco NX-OS=5.0\(3\)u1\(2\)

Cisco NX-OS=5.0\(3\)u1\(2a\)

Cisco NX-OS=5.0\(3\)u2\(1\)

Cisco NX-OS=5.0\(3\)u2\(2\)

Cisco NX-OS=5.0\(3\)u2\(2a\)

Cisco NX-OS=5.0\(3\)u2\(2b\)

Cisco NX-OS=5.0\(3\)u2\(2c\)

Cisco NX-OS=5.0\(3\)u2\(2d\)

Cisco NX-OS=5.0\(3\)u3\(1\)

Cisco NX-OS=5.0\(3\)u3\(2\)

Cisco NX-OS=5.0\(3\)u3\(2a\)

Cisco NX-OS=5.0\(3\)u3\(2b\)

Cisco NX-OS=5.0\(3\)u4\(1\)

Cisco NX-OS=5.0\(3\)u5\(1\)

Cisco NX-OS=5.0\(3\)u5\(1a\)

Cisco NX-OS=5.0\(3\)u5\(1b\)

Cisco NX-OS=5.0\(3\)u5\(1c\)

Cisco NX-OS=5.0\(3\)u5\(1d\)

Cisco NX-OS=5.0\(3\)u5\(1e\)

Any of the following

Cisco Nexus 7000

Cisco Nexus 7000 10-slot

Cisco Nexus 7000 18-slot

Cisco Nexus 7000 9-slot

Event History

May 24, 2014

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

May 26, 2014

Data Sourced

via NVD·12:25 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2014-2200?

The severity of CVE-2014-2200 is rated as high due to the potential for privilege escalation within multiple VDCs.

How do I fix CVE-2014-2200?

To fix CVE-2014-2200, upgrade to a fixed version of Cisco NX-OS that is 5.0(5) or later.

Who is affected by CVE-2014-2200?

CVE-2014-2200 affects Cisco Nexus 7000 devices running vulnerable versions of Cisco NX-OS prior to 5.0(5).

What causes CVE-2014-2200?

CVE-2014-2200 is caused by improper handling of SSH sessions that can enable remote authenticated users to escalate privileges across virtual device contexts.

Is there a workaround for CVE-2014-2200?

There is no known workaround for CVE-2014-2200; the only resolution is to apply the appropriate software update.

CVE-2014-2200: High severity Cisco NX-OS vulnerability

Affected Software

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2014-2200?

How do I fix CVE-2014-2200?

Who is affected by CVE-2014-2200?

What causes CVE-2014-2200?

Is there a workaround for CVE-2014-2200?

Company

Resources

Contact