CVE-2020-3398 (CNNVD-202008-1301)

HIGH
中文标题:
Cisco NX-OS Software 输入验证错误漏洞
英文标题:
Cisco NX-OS Software Border Gateway Protocol Multicast VPN Session Denial of Service Vulnerability
CVSS分数: 8.6
发布时间: 2020-08-27 15:40:28
漏洞类型: 输入验证错误
状态: PUBLISHED
数据质量分数: 0.30
数据版本: v3
漏洞描述
中文描述:

Cisco NX-OS Software是美国思科（Cisco）公司的一套交换机使用的数据中心级操作系统软件。TCP（Transmission Control Protocol,传输控制协议）是一种面向连接的、可靠的、基于字节流的传输层通信协议，由IETF的RFC 793定义。 Cisco NX-OS Border Gateway Protocol (BGP) Multicast VPN (MVPN) 组件存在安全漏洞，该漏洞是由于对特定类型的BGP MVPN更新消息的解析不正确造成的，攻击者可以通过将此BGP MVPN更新消息发送到目标设备来利用此漏洞。

英文描述:

A vulnerability in the Border Gateway Protocol (BGP) Multicast VPN (MVPN) implementation of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a BGP session to repeatedly reset, causing a partial denial of service (DoS) condition due to the BGP session being down. The vulnerability is due to incorrect parsing of a specific type of BGP MVPN update message. An attacker could exploit this vulnerability by sending this BGP MVPN update message to a targeted device. A successful exploit could allow the attacker to cause the BGP peer connections to reset, which could lead to BGP route instability and impact traffic. The incoming BGP MVPN update message is valid but is parsed incorrectly by the NX-OS device, which could send a corrupted BGP update to the configured BGP peer. Note: The Cisco implementation of BGP accepts incoming BGP traffic from only explicitly configured peers. To exploit this vulnerability, an attacker must send a specific BGP MVPN update message over an established TCP connection that appears to come from a trusted BGP peer. To do so, the attacker must obtain information about the BGP peers in the trusted network of the affected system.

CWE类型:
CWE-20
标签:
（暂无数据）
受影响产品
厂商 产品 版本 版本范围 平台 CPE
Cisco Cisco NX-OS Software n/a - - cpe:2.3:a:cisco:cisco_nx-os_software:n_a:*:*:*:*:*:*:*
cisco nx-os - - - cpe:2.3:o:cisco:nx-os:-:*:*:*:*:*:*:*
解决方案
中文解决方案:
（暂无数据）
英文解决方案:
（暂无数据）
临时解决方案:
（暂无数据）
参考链接
20200826 Cisco NX-OS Software Border Gateway Protocol Multicast VPN Session Denial of Service Vulnerability vendor-advisory
cve.org
访问
CVSS评分详情
3.0 (cna)
HIGH
8.6
CVSS向量: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
机密性
NONE
完整性
NONE
可用性
HIGH
时间信息
发布时间:
2020-08-27 15:40:28
修改时间:
2024-11-13 18:10:05
创建时间:
2025-11-11 15:36:19
更新时间:
2025-11-11 15:56:24
利用信息
暂无可利用代码信息
数据源详情
数据源 记录ID 版本 提取时间
CVE cve_CVE-2020-3398 2025-11-11 15:20:37 2025-11-11 07:36:19
NVD nvd_CVE-2020-3398 2025-11-11 14:57:02 2025-11-11 07:44:43
CNNVD cnnvd_CNNVD-202008-1301 2025-11-11 15:10:29 2025-11-11 07:56:24
版本与语言
当前版本: v3
主要语言: EN
支持语言:
EN ZH
安全公告
暂无安全公告信息
变更历史
v3 CNNVD
2025-11-11 15:56:24
vulnerability_type: 未提取 → 输入验证错误; cnnvd_id: 未提取 → CNNVD-202008-1301; data_sources: ['cve', 'nvd'] → ['cnnvd', 'cve', 'nvd']
查看详细变更
  • vulnerability_type: 未提取 -> 输入验证错误
  • cnnvd_id: 未提取 -> CNNVD-202008-1301
  • data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
v2 NVD
2025-11-11 15:44:43
affected_products_count: 1 → 2; data_sources: ['cve'] → ['cve', 'nvd']
查看详细变更
  • affected_products_count: 1 -> 2
  • data_sources: ['cve'] -> ['cve', 'nvd']