#BLOCKBLOCK ON OS UPGRADE#
#BLOCKBLOCK ON OS CODE#
#BLOCKBLOCK ON OS SERIES#

When considering software upgrades, customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page, to determine exposure and a complete upgrade solution. Customers should not deploy any workarounds or mitigations before first evaluating the applicability to their own environment and any impact to such environment. Customers should be aware that any workaround or mitigation that is implemented may negatively impact the functionality or performance of their network based on intrinsic customer deployment scenarios and limitations. While this mitigation has been deployed and was proven successful in a test environment, customers should determine the applicability and effectiveness in their own environment and under their own use conditions.

#BLOCKBLOCK ON OS SERIES#

For additional information, see Configuring Login Parameters in the Configuring AAA chapter of Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.3(x). However, removing the system login block-for configuration weakens the security posture of the device. If the command is removed using no login block-for seconds attempts tries within seconds, the device is no longer vulnerable. The device is only vulnerable if the system login block-for command is configured and a potential DoS attack was detected. There are no workarounds that address this vulnerability. The Login Profile configuration is disabled by default. If the Enable radio button is selected, the device is considered vulnerable.

Go to the Work pane and see the setting of the Enable radio button in the Admin State field.

Choose Expand All > User Management > User Services > Login Profile.Go to the Navigation pane and click Admin.To determine whether a UCS 6200 Series or 6300 Series Fabric Interconnect is configured to block login requests, use the Cisco UCS Manager web UI to perform the following steps: System login block-for 30 attempts 20 within 120 The following example shows the output of the show running-config | include block-for command if the system login block-for command is configured on a device that is running Cisco NX-OS Software: nexus# show running-config | include block-for If this command returns output, the device is considered vulnerable. To determine whether an affected device is configured with the login block-for or system login block-for CLI command, use the show running-config | include block-for command from the Cisco NX-OS CLI. See the bug ID(s) at the top of this advisory for the most complete and current information. At the time of publication, this vulnerability applied to both forms of the command.įor information about which Cisco software releases are vulnerable, see the Fixed Software section of this advisory.

#BLOCKBLOCK ON OS CODE#

Note: The login block-for mode command was renamed system login block-for on certain Cisco NX-OS platforms and newer code trains. The system login block-for command is disabled by default. UCS 6300 Series Fabric Interconnects ( CSCvx74585).UCS 6200 Series Fabric Interconnects ( CSCvx74585).Nexus 9000 Series Switches in standalone NX-OS mode ( CSCuz49095).Nexus 7000 Series Switches ( CSCuz49095).Nexus 6000 Series Switches ( CSCvw45963).Nexus 5600 Platform Switches ( CSCvw45963).Nexus 5500 Platform Switches ( CSCvw45963).Nexus 3000 Series Switches ( CSCuz49095).MDS 9000 Series Multilayer Switches ( CSCuz49095).For a complete list of the advisories and links to them, see Cisco Event Response: August 2021 Cisco FXOS and NX-OS Software Security Advisory Bundled Publication.Īt the time of publication, this vulnerability affected the following Cisco products if they were running a vulnerable release of Cisco NX-OS Software and had the system login block-for CLI command configured: This advisory is part of the August 2021 Cisco FXOS and NX-OS Software Security Advisory Bundled Publication. This advisory is available at the following link: A successful exploit could allow the attacker to cause a login process to reload, which could result in a delay during authentication to the affected device.Ĭisco has released software updates that address this vulnerability. An attacker could exploit this vulnerability by performing a brute-force login attack on an affected device. This vulnerability is due to a logic error in the implementation of the system login block-for command when an attack is detected and acted upon. A vulnerability in the implementation of the system login block-for command for Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a login process to unexpectedly restart, causing a denial of service (DoS) condition.

Blockblock on os