# MA-398.052014: MyCERT Advisory - Multiple Vulnerabilities in Cisco NX-OS-Based Products

**Date:** 23 May 2014  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-398.052014  
**Advisory ID:** MA-398.052014

---

**1.0 Introduction**
Cisco has released a security advisory to address multiple product vulnerabilities, which may allow a remote attacker to execute arbitrary code with elevated privileges.
**2.0 Impact**
- Successful exploitation of either the Cisco NX-OS Virtual Device Context SSH Privilege Escalation Vulnerability or the Cisco NX-OS Virtual Device Context SSH Key Privilege Escalation Vulnerability may allow an attacker to gain privileged access to a VDC in which the attacker does not otherwise have access.
- Successful exploitation of the Cisco NX-OS-Based Products Smart Call Home Buffer Overflow Vulnerability may allow an attacker to execute arbitrary code with elevated privileges. This could result in a complete compromise of the affected device.
- Successful exploitation of the Cisco NX-OS Message Transfer Service Denial of Service Vulnerability may allow an attacker to create a DoS condition on the affected device. In some instances administrator intervention may be required to return the device to operational status.
**3.0 Affected Products**
Cisco products running or based on the Cisco NX-OS Software high-speed routing and switching platform are affected by one or more of the vulnerabilities detailed in the advisory provided by Cisco.
**4.0 Recommendation**
Cisco has released free software updates that address the vulnerability described in this advisory. Prior to deploying software, customers are advised to consult their maintenance providers or check the software for feature set compatibility and known issues that are specific to their environments.
MyCERT encourages users and administrators of these products to review the advisories provided by Cisco below and apply any necessary fixes and updates to help mitigate the risks.
- [Multiple Vulnerabilities in Cisco NX-OS-Based Products](http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140521-nxos)
Generally, MyCERT advises users of this product to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection#afccd6cdcadd969696efccd6cdcadddccaccdaddc6dbd681c2d6) or [[email protected]](/cdn-cgi/l/email-protection#3a5743595f484e7a5743595f484e1455485d145743)
Phone: 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web: <https://www.mycert.org.my>
Twitter: <http://www.twitter.com/mycert>
**5.0References**
- US CERT: Cisco Releases Security Advisories, May 2014 [online].
<https://www.us-cert.gov/ncas/current-activity/2014/05/21/Cisco-Releases-Security-Advisories>
- Cisco Security Advisory: Multiple Vulnerabilities in Cisco NX-OS-Based Products, May 2014 [online].
<http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140521-nxos>
- AUSCERT, May 2014 [online].
<https://www.auscert.org.au/render.html?it=19720>