Hash: SHA256

             AUSCERT External Security Bulletin Redistribution

       Cisco Nexus 5600 and 6000 Series Switches Fibre Channel over
                 Ethernet Denial of Service Vulnerability
                               7 March 2019


        AusCERT Security Bulletin Summary

Product:           Cisco Nexus 5600 Switches
                   Cisco Nexus 6000 Switches
Publisher:         Cisco Systems
Operating System:  Cisco
Impact/Access:     Denial of Service -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2019-1595  

Original Bulletin: 

- --------------------------BEGIN INCLUDED TEXT--------------------

Cisco Nexus 5600 and 6000 Series Switches Fibre Channel over Ethernet Denial of
Service Vulnerability

Priority:        Medium

Advisory ID:     cisco-sa-20190306-nexus-fbr-dos

First Published: 2019 March 6 16:00 GMT

Version 1.0:     Final

Workarounds:     No workarounds available

Cisco Bug IDs:   CSCvn24414



CVSS Score:


  o A vulnerability in the Fibre Channel over Ethernet (FCoE) protocol
    implementation in Cisco NX-OS Software could allow an unauthenticated,
    adjacent attacker to cause a denial of service (DoS) condition on an
    affected device.

    The vulnerability is due to an incorrect allocation of an internal
    interface index. An adjacent attacker with the ability to submit a crafted
    FCoE packet that crosses affected interfaces could trigger this
    vulnerability. A successful exploit could allow the attacker to cause a
    packet loop and high throughput on the affected interfaces, resulting in a
    DoS condition.

    Cisco has released software updates that address this vulnerability. There
    are no workarounds that address this vulnerability.

    This advisory is available at the following link:

Affected Products

  o Vulnerable Products

    This vulnerability affects the following Cisco products if they are running
    a vulnerable release of Cisco NX-OS Software:

       Nexus 5600 Platform Switches
       Nexus 6000 Series Switches

    Note: For this vulnerability to occur, all of the following conditions must
    be met:

       Two vulnerable products need to be connected to each other via Ethernet
        ports with an incorrect internal mapping.
       The fcoe OR fcoe-npv feature must enabled.
       The vulnerable ports must not be configured for FCoE.

    See the Details section for more information.

    For information about which Cisco NX-OS Software releases are vulnerable,
    see the Fixed Software section of this advisory.

    Determining the Cisco NX-OS Software Release

    Administrators can check the release of Cisco NX-OS Software that is
    running on a device by using the show version command in the device CLI.
    The following example shows the output of the command for a device that is
    running Cisco NX-OS Software Release 7.3(4)N1(1) :

        nxos-switch#show version
        Cisco Nexus Operating System (NX-OS) Software
        TAC support: http://www.cisco.com/tac
        Documents: http://www.cisco.com/en/US/products/ps9372/tsd_products_support_series_home.html
        Copyright (c) 2002-2018, Cisco Systems, Inc. All rights reserved.
        The copyrights to certain works contained herein are owned by
        other third parties and are used and distributed under license.
        Some parts of this software are covered under the GNU Public
        License. A copy of the license is available at

        BIOS: version 3.6.0
        Power Sequencer Firmware:
        Module 1: v3.0
        Module 2: v5.0
        Microcontroller Firmware: version v1.2.0.1
        QSFP Microcontroller Firmware:
        Module not detected
        CXP Microcontroller Firmware:
        Module not detected
        kickstart: version 7.3(4)N1(1)
        system: version 7.3(4)N1(1)
        BIOS compile time: 05/09/2012
        kickstart image file is: bootflash:///n5000-uk9-kickstart.7.3.4.N1.1.bin
        kickstart compile time: 9/10/2018 0:00:00 [09/10/2018 08:29:28]
        system image file is: bootflash:///n5000-uk9.7.3.4.N1.1.bin
        system compile time: 9/10/2018 0:00:00 [09/10/2018 12:41:33]



    Products Confirmed Not Vulnerable

    Only products listed in the Vulnerable Products section of this advisory
    are known to be affected by this vulnerability.

    Cisco has confirmed that this vulnerability does not affect the following
    Cisco products:

       Firepower 2100 Series Firewalls
       Firepower 4100 Series Next-Generation Firewalls
       Firepower 9300 Security Appliance
       MDS 9000 Series Multilayer Switches
       Nexus 1000V Switch for Microsoft Hyper-V
       Nexus 1000V Switch for VMware vSphere
       Nexus 2000 Series Fabric Extenders
       Nexus 3000 Series Switches
       Nexus 3500 Platform Switches
       Nexus 3600 Platform Switches
       Nexus 5500 Platform Switches
       Nexus 7000 Series Switches
       Nexus 7700 Series Switches
       Nexus 9000 Series Fabric Switches in Application Centric Infrastructure
        (ACI) mode
       Nexus 9000 Series Switches in standalone NX-OS mode
       UCS 6200 Series Fabric Interconnects
       UCS 6300 Series Fabric Interconnects
       UCS 6400 Series Fabric Interconnects


  o This vulnerability requires fcoe to be enabled. To see if the fcoe or
    fcoe-npv feature is configured, use the show feature | include fcoe CLI

        N5K-A# show feature | include fcoe
        fcoe                  1         enabled
        fcoe-npv              1         disabled

    This vulnerability also requires that an Ethernet interface not be bound to
    an FCoE virtual Fibre Channel (vFC) interface. To see if an Ethernet
    interface is bound to a vFC interface, use the show interface brief CLI

        N5K-A# show interface brief

        Interface  Vsan   Admin  Admin   Status          SFP    Oper  Oper   Port
                          Mode   Trunk                          Mode  Speed  Channel
                                 Mode                                 (Gbps)
        fc1/29     200    F      off     notConnected     swl    --           200
        fc1/30     200    F      off     notConnected     swl    --           200
        fc1/31     100    F      off     notConnected     swl    --           100
        fc1/32     100    F      off     notConnected     swl    --           100

        Ethernet      VLAN    Type Mode   Status  Reason                   Speed     Port
        Interface                                                                    Ch #
        Eth1/1        1       eth  trunk  down    SFP not inserted            10G(D) --
        Eth1/2        1       eth  access down    SFP not inserted            10G(D) --


        Port   VRF          Status IP Address                              Speed    MTU
        mgmt0  --           up                           100      1500

        Interface   Vsan  Admin Admin   Status      Bind                 Oper     Oper
                          Mode  Trunk               Info                 Mode     Speed
                                Mode                                             (Gbps)
        vfc100       100  F     on     trunking    00:10:94:00:00:02        TF   auto
        vfc111       100  F     on     trunking    Eth1/1                   TF   auto
        vfc200       200  F     on     trunking    00:20:94:00:00:02        TF   auto

    In this example, Eth1/1 would not be vulnerable because it is bound to a

Indicators of Compromise

  o If the devices are configured as outlined in the Vulnerable Products 
    section, a possible indicator of compromise would be a high Rx input rate
    on a vulnerable interface coupled with a high Tx rate for all enabled
    interfaces configured for the same VLAN as shown in the following example:

        N6K-A# show interface eth1/2 counters brief

        Interface         Input Rate (avg)    Output Rate (avg)
                          ------------------  ------------------
                          Rate     Total      Rate     Total        Rate averaging
                          MB/s     Frames     MB/s     Frames       interval (seconds)
        Eth1/2            1140     5482344    1140     5482507      30
                          1140     5482321    1140     5482488      300

        N6K-A# show interface Ethernet 1/11 counters brief

        Interface         Input Rate (avg)    Output Rate (avg)
                          ------------------  ------------------
                          Rate     Total      Rate     Total        Rate averaging
                          MB/s     Frames     MB/s     Frames       interval (seconds)
        Eth1/11           0        0          1140     5482508      30
                          0        0          1140     5482496      300

        N6K-A# show interface Ethernet 1/16 counters brief

        Interface         Input Rate (avg)    Output Rate (avg)
                          ------------------  ------------------
                          Rate     Total      Rate     Total        Rate averaging
                          MB/s     Frames     MB/s     Frames       interval (seconds)
        Eth1/16           0        0          1140     5482504      30
                          0        0          1140     5482565      300

    If there are any questions regarding the output of your device or the
    information above, please contact Cisco TAC:



  o There are no workarounds that address this vulnerability.

Fixed Software

  o Cisco has released free software updates that address the vulnerability
    described in this advisory. Customers may only install and expect support
    for software versions and feature sets for which they have purchased a
    license. By installing, downloading, accessing, or otherwise using such
    software upgrades, customers agree to follow the terms of the Cisco
    software license:

    Additionally, customers may only download software for which they have a
    valid license, procured from Cisco directly, or through a Cisco authorized
    reseller or partner. In most cases this will be a maintenance upgrade to
    software that was previously purchased. Free security software updates do
    not entitle customers to a new software license, additional software
    feature sets, or major revision upgrades.

    When considering software upgrades, customers are advised to regularly
    consult the advisories for Cisco products, which are available from the
    Cisco Security Advisories and Alerts page, to determine exposure and a
    complete upgrade solution.

    In all cases, customers should ensure that the devices to be upgraded
    contain sufficient memory and confirm that current hardware and software
    configurations will continue to be supported properly by the new release.
    If the information is not clear, customers are advised to contact the Cisco
    Technical Assistance Center (TAC) or their contracted maintenance

    Customers Without Service Contracts

    Customers who purchase directly from Cisco but do not hold a Cisco service
    contract and customers who make purchases through third-party vendors but
    are unsuccessful in obtaining fixed software through their point of sale
    should obtain upgrades by contacting the Cisco TAC: https://www.cisco.com/c

    Customers should have the product serial number available and be prepared
    to provide the URL of this advisory as evidence of entitlement to a free

    Fixed Releases

    In the following table, the left column lists releases of Cisco NX-OS
    Software. The right column indicates whether a release is affected by the
    vulnerability described in this advisory and the first release that
    includes the fix for this vulnerability. Customers are advised to upgrade
    to an appropriate fixed software release as indicated in this section.

    Nexus 5600 and 6000 Series Switches: CSCvn24414

    Cisco NX-OS Software Release   First Fixed Release for This Vulnerability
    Prior to 5.2                   Not vulnerable
    5.2                            Not vulnerable
    6.0                            7.1(5)N1(1b)
    7.0                            7.1(5)N1(1b)
    7.1                            7.1(5)N1(1b)
    7.2                            7.3(5)N1(1)
    7.3                            7.3(5)N1(1)

    Additional Resources

    For help determining the best Cisco NX-OS Software release for a Cisco
    Nexus Switch, administrators can refer to the following Recommended
    Releases documents. If a security advisory recommends a later release,
    Cisco recommends following the advisory guidance.

        Cisco MDS Series Switches
        Cisco Nexus 1000V for VMware Switch
        Cisco Nexus 3000 Series and 3500 Series Switches
        Cisco Nexus 5000 Series Switches
        Cisco Nexus 5500 Platform Switches
        Cisco Nexus 6000 Series Switches
        Cisco Nexus 7000 Series Switches
        Cisco Nexus 9000 Series Switches
        Cisco Nexus 9000 Series ACI-Mode Switches

    For help determining the best Cisco NX-OS Software release for Cisco UCS,
    refer to the Recommended Releases documents in the release notes for the

Exploitation and Public Announcements

  o The Cisco Product Security Incident Response Team (PSIRT) is not aware of
    any public announcements or malicious use of the vulnerability that is
    described in this advisory.


  o This vulnerability was found during the resolution of a Cisco TAC support

Cisco Security Vulnerability Policy

  o To learn about Cisco security vulnerability disclosure policies and
    publications, see the Security Vulnerability Policy . This document also
    contains instructions for obtaining fixed software and receiving security
    vulnerability information from Cisco.


  o https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/

Revision History

  o +---------+--------------------------+---------+--------+----------------+
    | Version |       Description        | Section | Status |      Date      |
    | 1.0     | Initial public release.  | -       | Final  | 2019-March-06  |

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:


Australian Computer Emergency Response Team
The University of Queensland
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
Comment: http://www.auscert.org.au/render.html?it=1967