Vulnerability Description
Cisco Nexus 1000V Virtual Ethernet Module (VEM) 4.0(4) SV1(1) through SV1(3b), as used in VMware ESX 4.0 and 4.1 and ESXi 4.0 and 4.1, does not properly handle dropped packets, which allows guest OS users to cause a denial of service (ESX or ESXi host OS crash) by sending an 802.1Q tagged packet over an access vEthernet port, aka Cisco Bug ID CSCtj17451.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cisco | 1000V Virtual Ethernet Module \(Vem\) | 4.0\(4\) |
| Vmware | Esx | 4.0 |
| Vmware | Esxi | 4.0 |
Related Weaknesses (CWE)
References
- http://lists.vmware.com/pipermail/security-announce/2011/000118.html
- http://secunia.com/advisories/43084Vendor Advisory
- http://securityreason.com/securityalert/8090
- http://securitytracker.com/id?1025030
- http://www.cisco.com/en/US/docs/switches/datacenter/nexus1000/sw/4_0_4_s_v_1_3_c
- http://www.osvdb.org/70837
- http://www.securityfocus.com/archive/1/516259/100/0/threaded
- http://www.securityfocus.com/bid/46247
- http://www.vmware.com/security/advisories/VMSA-2011-0002.htmlVendor Advisory
- http://www.vupen.com/english/advisories/2011/0314Vendor Advisory
- http://www.vupen.com/english/advisories/2011/0315Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/65217
- http://lists.vmware.com/pipermail/security-announce/2011/000118.html
- http://secunia.com/advisories/43084Vendor Advisory
- http://securityreason.com/securityalert/8090
FAQ
What is CVE-2011-0355?
CVE-2011-0355 is a vulnerability with a CVSS score of 7.8 (HIGH). Cisco Nexus 1000V Virtual Ethernet Module (VEM) 4.0(4) SV1(1) through SV1(3b), as used in VMware ESX 4.0 and 4.1 and ESXi 4.0 and 4.1, does not properly handle dropped packets, which allows guest OS u...
How severe is CVE-2011-0355?
CVE-2011-0355 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2011-0355?
Check the references section above for vendor advisories and patch information. Affected products include: Cisco 1000V Virtual Ethernet Module \(Vem\), Vmware Esx, Vmware Esxi.