Cisco Nexus 1000V Insufficient VSM/VEM Authentication Vulnerability

A vulnerability in the Cisco Nexus 1000V could allow an unauthenticated, remote attacker to obtain control over a Virtual Ethernet Module VEM and associated port groups. The vulnerability is due to insufficient authentication between a VEM and a Virtual Supervisor Module VSM. An attacker could...

PT-2013-2971

Name of the Vulnerable Software and Affected Versions Cisco Nexus 1000V affected versions not specified Description The encryption functionality in Cisco NX-OS does not properly handle Virtual Supervisor Module VSM to Virtual Ethernet Module VEM communication. This allows remote attackers to...

PT-2013-2973

Name of the Vulnerable Software and Affected Versions Cisco Nexus 1000V Virtual Ethernet Module VEM kernel driver for VMware ESXi affected versions not specified Description A denial of service issue exists due to insufficient validation of STUN protocol packets, resulting in an out of bound arra...

PT-2013-2972

Name of the Vulnerable Software and Affected Versions Cisco Nexus 1000V affected versions not specified Description The encryption functionality in the Virtual Supervisor Module VSM to Virtual Ethernet Module VEM communication component does not properly authenticate VSM/VEM packets. This allows...

PT-2013-2974

Name of the Vulnerable Software and Affected Versions Cisco NX-OS on the Nexus 1000V affected versions not specified Description The issue is related to insufficient authentication between a Virtual Ethernet Module VEM and a Virtual Supervisor Module VSM in Cisco Nexus 1000V. This allows remote...

PT-2013-2975

Name of the Vulnerable Software and Affected Versions Cisco Nexus 1000V affected versions not specified Description The SSL functionality in Cisco NX-OS does not properly verify X.509 certificates, allowing man-in-the-middle attackers to spoof servers and intercept or modify Virtual Supervisor...

CVE-2013-1209: Improper Authentication

The encryption functionality in the Virtual Supervisor Module VSM to Virtual Ethernet Module VEM communication component in Cisco NX-OS on the Nexus 1000V does not properly authenticate VSM/VEM packets, which allows remote attackers to disable packet-level encryption and integrity protection via...

CVE-2013-1211: Improper Authentication

Cisco NX-OS on the Nexus 1000V does not properly handle authentication for Virtual Ethernet Module VEM to Virtual Supervisor Module VSM communication, which allows remote attackers to obtain VEM access via 1 spoofed STUN packets or 2 a crafted VMware ESXi instance, aka Bug ID CSCud14832...

CVE-2013-1212: Undefined Security Weakness

The SSL functionality in Cisco NX-OS on the Nexus 1000V does not properly verify X.509 certificates, which allows man-in-the-middle attackers to spoof servers, and intercept or modify Virtual Supervisor Module VSM to VMware vCenter communication, via a crafted certificate, aka Bug ID CSCud14837...

CVE-2013-1210: Improper Restriction of Operations within the Bounds of a Memory Buffer

Array index error in the Virtual Ethernet Module VEM kernel driver for VMware ESXi in Cisco NX-OS on the Nexus 1000V, when STUN debugging is enabled, allows remote attackers to cause a denial of service ESXi crash and purple screen of death by sending crafted STUN packets to a VEM, aka Bug ID...

CVE-2013-1208: Undefined Security Weakness

The encryption functionality in Cisco NX-OS on the Nexus 1000V does not properly handle Virtual Supervisor Module VSM to Virtual Ethernet Module VEM communication, which allows remote attackers to intercept or modify network traffic by leveraging certain Layer 2 or Layer 3 access, aka Bug ID...

CVE-2013-1213: Undefined Security Weakness

Cisco NX-OS on the Nexus 1000V does not assign the proper priority to heartbeat messages from a Virtual Ethernet Module VEM to a Virtual Supervisor Module VSM, which allows remote attackers to cause a denial of service false VEM unavailability report via a flood of UDP packets, aka Bug ID...

PT-2013-2976

Name of the Vulnerable Software and Affected Versions Cisco NX-OS on the Nexus 1000V affected versions not specified Description The issue is related to the insufficient prioritization of heartbeat messages between a Virtual Ethernet Module VEM and a Virtual Supervisor Module VSM. This allows...

CVE-2013-1226

The Ethernet frame-forwarding implementation in Cisco NX-OS on Nexus 7000 devices allows remote attackers to cause a denial of service forwarding loop and service outage via a crafted frame, aka Bug ID CSCug47098...

Design/Logic Flaw

The Ethernet frame-forwarding implementation in Cisco NX-OS on Nexus 7000 devices allows remote attackers to cause a denial of service forwarding loop and service outage via a crafted frame, aka Bug ID CSCug47098...

CVE-2013-1226

CVE-2013-1226 affects Cisco NX-OS on Nexus 7000 series switches. The vulnerability is in the Ethernet frame-forwarding implementation and can be exploited remotely by sending a crafted nonstandard Ethernet frame from an adjacent network to cause a forwarding loop and resulting DoS. Affected compo...

CVE-2013-1226

The Ethernet frame-forwarding implementation in Cisco NX-OS on Nexus 7000 devices allows remote attackers to cause a denial of service forwarding loop and service outage via a crafted frame, aka Bug ID CSCug47098...

PT-2013-2989

Name of the Vulnerable Software and Affected Versions Cisco NX-OS versions on Nexus 7000 devices affected versions not specified Description The issue is related to the mishandling of nonstandard Ethernet frames by the Cisco NX-OS software, which can be exploited by an unauthenticated, remote...

CVE-2013-1226: Improper Restriction of Operations within the Bounds of a Memory Buffer

The Ethernet frame-forwarding implementation in Cisco NX-OS on Nexus 7000 devices allows remote attackers to cause a denial of service forwarding loop and service outage via a crafted frame, aka Bug ID CSCug47098...

Lock Screen Bypass Flaw Found in Viber for Android

Another day, another smartphone lock screen bypass vulnerability. This time a flaw in a popular messaging application for the Android mobile platform is to blame. Viber, which is similar to Skype in that it allows users to make free phone calls and send instant messages, is vulnerable to a flaw...