发布日期：2019-05-15
更新日期：2019-05-22

受影响系统：

Cisco NX-OS Software for UCS 6300 Fabric Interconne
Cisco NX-OS Software for UCS 6300 Fabric Interconne
Cisco NX-OS Software for UCS 6200 Fabric Interconne
Cisco NX-OS Software for UCS 6200 Fabric Interconne
Cisco NX-OS Software for Nexus 7700 Series 8.2
Cisco NX-OS Software for Nexus 7700 Series 8.1
Cisco NX-OS Software for Nexus 7700 Series 8.0
Cisco NX-OS Software for Nexus 7700 Series 7.3
Cisco NX-OS Software for Nexus 7700 Series 7.2
Cisco NX-OS Software for Nexus 7000 Series 8.2
Cisco NX-OS Software for Nexus 7000 Series 8.1
Cisco NX-OS Software for Nexus 7000 Series 8.0
Cisco NX-OS Software for Nexus 7000 Series 7.3
Cisco NX-OS Software for Nexus 7000 Series 7.2
Cisco NX-OS Software for MDS 9700 Series 8.2
Cisco NX-OS Software for MDS 9700 Series 8.1
Cisco NX-OS Software for MDS 9700 Series 7.3

不受影响系统：

Cisco NX-OS Software for UCS 6300 Fabric Interconne
Cisco NX-OS Software for UCS 6200 Fabric Interconne
Cisco NX-OS Software for Nexus 7700 Series 8.2(3)
Cisco NX-OS Software for Nexus 7700 Series 7.3(3)D1
Cisco NX-OS Software for Nexus 7000 Series 8.2(3)
Cisco NX-OS Software for Nexus 7000 Series 7.3(3)D1
Cisco NX-OS Software for MDS 9700 Series 8.3(1)
Cisco NX-OS Software for MDS 9700 Series 8.1(1a)

描述：

---

BUGTRAQ  ID: 108375
CVE(CAN) ID: CVE-2019-1809

Cisco NX-OS Software是美国思科（Cisco）公司的一套交换机使用的数据中心级操作系统软件。
Cisco NX-OS Software的映像签名验证功能存在一个漏洞，允许经过身份验证的本地攻击者使用管理员级别凭据在受影响设备上安装恶意软件补丁。
该漏洞产生原因是对补丁图像的数字签名的不正确验证。通过制作未签名的软件修复补丁来绕过签名检查并将其加载到受影响的设备上，攻击者可利用此漏洞，启动恶意软件补丁映像。
如果以下Cisco产品运行含有漏洞的Cisco NX-OS Software版本，则会受此漏洞影响：
-MDS 9700 Series Multilayer Directors
-Nexus 7000 Series Switches
-Nexus 7700 Series Switches
-UCS 6200 Series Fabric Interconnects
-UCS 6300 Series Fabric Interconnects

<*来源：Cisco
  
  链接：https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-psvb
*>

建议：

---

厂商补丁：

Cisco
-----
Cisco已经为此发布了一个安全公告（cisco-sa-20190515-nxos-psvb）以及相应补丁:
cisco-sa-20190515-nxos-psvb：Cisco NX-OS Software Patch Signature Verification Bypass Vulnerability
链接：https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-psvb

补丁下载：

浏览次数：1889
严重程度：0（网友投票）