Lucene search

K
nessusThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.CISCO-SA-20190306-NXOS-NETSTACK.NASL
HistoryMar 27, 2020 - 12:00 a.m.

Cisco NX-OS Software Netstack DoS (cisco-sa-20190306-nxos-netstack)

2020-03-2700:00:00
This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
www.tenable.com
29

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

EPSS

0.002

Percentile

52.3%

A denial of service (DoS) vulnerability exists in Cisco NX-OS Software due to allocating and freeing memory buffers in the network stack. An unauthenticated, remote attacker can exploit this issue by sending crafted TCP streams to an affected device in a sustained way. If the attacker is succesful then this will result in the network stack running out of available buffers, thus impairing operations of the control plane and management plane protocols.

Please see the included Cisco BIDs and Cisco Security Advisory for more information

#TRUSTED 819a11cde8a9096ca3c21684f3d3eec4420fc29d0054015944183bc60e81858a9917bce4dca36d8646250bb426f58bcbbd80393fd6022a1298dd2ec49ba79921b1461621f3447ed414e306f42f9e839ed8d2f2f6bb418179c9ea93b6526071ad89cf7db3d07dcbce856b2861c4c15fadd88c33ee2f7dbf2be3adbb94af6050bf2925543d265486692d132f2c468421fcdac5b4e74e0b4e1c37e6072bef7c655394b0d641fdba98e5c225929acbc82d91386d99df941129b9469b948c6fcb59d1e2709a006df2bd49fdd900b548dbbddfadbf45e8359e51359e1d4b500f2a6d6680f3d152bd93d588f4db7c21d3b33ca3cea9dd92174931fe1d3b37298f6d8699c8c7bf21efd6ea08c249848b1fc8ac6df088ed6b0337817ad1a35aaee92dd308bc14dbe74fcaa933848b141785ccbb0a5fa14e00def7bbabe2eb7e16e2661072e70e58efbeedff5f9a2a884bbc8dbf0111f248e654dc7b8e3d05c99c4f77b46e63cb4aa9219621802b2663c83e56431dca2474b81c4e36a37c898c7299fcbbb3bc79adfce958444b78a070a41f38d05bc629a3ab743e769a82d384ded2adc5231199fe747dd86575ee8a8986db752c51b5badb5154f2cb050c54d360bb0ef3e4c49d1a66e2be5193ae7bf7ede7b059f8351159894170e061a89f234743e8e16d2246c0d362a8630ef9fb11c1dbacff5df59dd94830f2c4b25bdc2b05e9eed9fc
#
# (C) Tenable Network Security, Inc.
#

include('compat.inc');

if (description)
{
  script_id(134948);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/31");

  script_cve_id("CVE-2019-1599");
  script_xref(name:"CISCO-BUG-ID", value:"CSCvk55013");
  script_xref(name:"CISCO-BUG-ID", value:"CSCvm53108");
  script_xref(name:"CISCO-BUG-ID", value:"CSCvm53112");
  script_xref(name:"CISCO-BUG-ID", value:"CSCvm53113");
  script_xref(name:"CISCO-BUG-ID", value:"CSCvm53114");
  script_xref(name:"CISCO-BUG-ID", value:"CSCvm53115");
  script_xref(name:"CISCO-BUG-ID", value:"CSCvm53116");
  script_xref(name:"CISCO-BUG-ID", value:"CSCvm53125");
  script_xref(name:"CISCO-BUG-ID", value:"CSCvm53128");
  script_xref(name:"CISCO-SA", value:"cisco-sa-20181017-fxnx-os-dos");

  script_name(english:"Cisco NX-OS Software Netstack DoS (cisco-sa-20190306-nxos-netstack)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch");
  script_set_attribute(attribute:"description", value:
"A denial of service (DoS) vulnerability exists in Cisco NX-OS Software due to allocating and freeing memory buffers in
the network stack. An unauthenticated, remote attacker can exploit this issue by sending crafted TCP streams to an affected
device in a sustained way. If the attacker is succesful then this will result in the network stack running out of available
buffers, thus impairing operations of the control plane and management plane protocols.

Please see the included Cisco BIDs and Cisco Security Advisory for more information");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-nxos-netstack
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?afa8810a");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvk55013");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvm53108");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvm53112");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvm53113");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvm53114");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvm53115");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvm53116");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvm53125");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvm53128");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug IDs CSCvi92332");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-1599");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_cwe_id(399);

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/03/06");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/03/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2020/03/27");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nx-os");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_nxos_version.nasl");
  script_require_keys("Host/Cisco/NX-OS/Model", "Host/Cisco/NX-OS/Version", "Host/Cisco/NX-OS/Device");

  exit(0);
}

include('ccf.inc');
include('cisco_workarounds.inc');

product_info = cisco::get_product_info(name:'Cisco NX-OS Software');
model = toupper(product_info['model']);
device = toupper(product_info['device']);
version = toupper(product_info['version']);

if ('UCS' >< device) {
  if (model =~ "^(62|63)[0-9]{2}$") {
    bug_id = 'CSCvm53116';
    vuln_ranges = [
      {'min_ver' : '0.0', 'fix_ver' : '3.2(3j)'},
      {'min_ver' : '4.0', 'fix_ver' : '4.0(2a)'}
    ];
  }
  else if (model =~ "^64[0-9]{2}$") {
    bug_id = 'CSCvm53125';
    vuln_ranges = [
      {'min_ver' : '4.0', 'fix_ver' : '4.0(2a)'}
    ];
  }
}
else if ('NEXUS' >< device) {
  # check if 1000v for Hyper-V
  if ("1000V" >< model && "SM" >< version) {
    bug_id = 'CSCvm53112';
    vuln_ranges = [
    {'min_ver' : '0.0', 'fix_ver' : '5.2(1)SM3(2.1)'}
    ];
  }
  # check if 1000v for VMWare
  else if ("1000V" >< model && "SV" >< version) {
    bug_id = 'CSCvm53113';
    vuln_ranges = [
      {'min_ver' : '0.0', 'fix_ver' : '5.2(1)SV3(4.1a)'}
    ];
  }
  # check if 3000 series
  else if (model =~ "^30[0-9]{2}$") {
    bug_id = 'CSCvk55013';
    vuln_ranges = [
      {'min_ver' : '0.0', 'fix_ver' : '7.0(3)I4(9)'},
      {'min_ver' : '9.2', 'fix_ver' : '9.2(2)'}
    ];
  }
  # check if 3500 series
  else if (model =~ "^35[0-9]{2}$") {
    bug_id = 'CSCvm53114';
    vuln_ranges = [
      {'min_ver' : '0.0', 'fix_ver' : '6.0(2)A8(11)'},
      {'min_ver' : '7.0(3)', 'fix_ver' : '7.0(3)I7(6)'},
      {'min_ver' : '9.2', 'fix_ver' : '9.2(2)'}
    ];
  }
  # check if 3600 series
  else if (model =~ "^36[0-9]{2}$") {
    bug_id = 'CSCvm53108';
    vuln_ranges = [
      {'min_ver' : '7.0(3)', 'fix_ver' : '7.0(3)F3(5)'},
      {'min_ver' : '9.2', 'fix_ver' : '9.2(2)'}
    ];
  }
  # check if 5500, 5600, or 6000 series
  else if (model =~ "^5[5-6][0-9]{2}$" ||
  model =~ "6[0-9]{2}") {
    bug_id = 'CSCvm53115';
    vuln_ranges = [
      {'min_ver' : '0.0', 'fix_ver' : '7.1(5)N1(1b)'},
      {'min_ver' : '7.2', 'fix_ver' : '7.3(5)N1(1)'}
    ];
  }
  # check if 7000 or 7700 series
  else if (model =~ "^7(0|7)[0-9]{2}$") {
    bug_id = 'CSCvm53128';
    vuln_ranges = [
      {'min_ver' : '0.0', 'fix_ver' : '6.2(22)'},
      {'min_ver' : '7.2', 'fix_ver' : '7.3(3)D1(1)'},
      {'min_ver' : '8.0', 'fix_ver' : '8.2(3)'},
      {'min_ver' : '8.3', 'fix_ver' : '8.3(2)'}
    ];
  }
  # check if 9000 series
  else if (model =~ "^90[0-9]{2}$") {
    bug_id = 'CSCvk55013';
    vuln_ranges = [
      {'min_ver' : '0.0', 'fix_ver' : '7.0(3)I4(9)'},
      {'min_ver' : '7.0(3)I5', 'fix_ver' : '7.0(3)I7(6)'},
      {'min_ver' : '9.2', 'fix_ver' : '9.2(2)'}
    ];
  }
  # check if 9500 R-Series
  else if (model =~ "^95[0-9]{2} R$") {
    bug_id = 'CSCvm53108';
    vuln_ranges = [
      {'min_ver' : '7.0(3)', 'fix_ver' : '7.0(3)F3(5)'},
      {'min_ver' : '9.2', 'fix_ver' : '9.2(2)'}
    ];
  }
}
if (bug_id == '') {
  audit(AUDIT_HOST_NOT, 'an affected model');
}

workarounds = make_list(CISCO_WORKAROUNDS['no_workaround']);
workaround_params = [];

reporting = make_array(
  'port'     , 0,
  'severity' , SECURITY_HOLE,
  'bug_id'   , bug_id,
  'version'  , product_info['version']
);

cisco::check_and_report(
  product_info:product_info,
  workarounds       : workarounds,
  workaround_params : workaround_params,
  reporting         : reporting,
  vuln_ranges       : vuln_ranges
);
VendorProductVersionCPE
cisconx-oscpe:/o:cisco:nx-os

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

EPSS

0.002

Percentile

52.3%

Related for CISCO-SA-20190306-NXOS-NETSTACK.NASL