4.6 Medium
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:P/A:P
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
0.0004 Low
EPSS
Percentile
5.1%
According to its self-reported version, Cisco NX-OS Software is affected by a vulnerability in the CLI of Cisco NX-OS Software. This vulnerability could allow an authenticated, local attacker to escalate lower-level privileges to the administrator level. The vulnerability is due to insufficient authorization enforcement. An attacker could exploit this vulnerability by authenticating to the targeted device and executing commands that could lead to elevated privileges. A successful exploit could allow an attacker to make configuration changes to the system as administrator. (CVE-2019-1603)
Please see the included Cisco BIDs and Cisco Security Advisory for more information
#
# (C) Tenable Network Security, Inc.
#
include('compat.inc');
if (description)
{
script_id(131778);
script_version("1.2");
script_cvs_date("Date: 2019/12/10");
script_cve_id("CVE-2019-1603");
script_bugtraq_id(107328);
script_xref(name:"CISCO-BUG-ID", value:"CSCvj00330");
script_xref(name:"CISCO-BUG-ID", value:"CSCvh24810");
script_xref(name:"CISCO-SA", value:"cisco-sa-20190306-nxos-privesc");
script_name(english:"Cisco NX-OS Software Privilege Escalation Vulnerability");
script_summary(english:"Checks the version of Cisco NX-OS Software");
script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch");
script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco NX-OS Software is affected by a vulnerability in the CLI of Cisco NX-OS
Software. This vulnerability could allow an authenticated, local attacker to escalate lower-level privileges to the
administrator level. The vulnerability is due to insufficient authorization enforcement. An attacker could exploit this
vulnerability by authenticating to the targeted device and executing commands that could lead to elevated privileges. A
successful exploit could allow an attacker to make configuration changes to the system as administrator. (CVE-2019-1603)
Please see the included Cisco BIDs and Cisco Security Advisory for more information");
# https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-nxos-privesc
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b511bbd8");
script_set_attribute(attribute:"see_also", value:"http://tools.cisco.com/security/center/viewErp.x?alertId=ERP-70757");
script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvj00330");
script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvh24810");
script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCvj00330 and CSCvh24810");
script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P");
script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-1603");
script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
script_cwe_id(285);
script_set_attribute(attribute:"vuln_publication_date", value:"2019/03/06");
script_set_attribute(attribute:"patch_publication_date", value:"2019/03/06");
script_set_attribute(attribute:"plugin_publication_date", value:"2019/12/09");
script_set_attribute(attribute:"plugin_type", value:"combined");
script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nx-os");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"CISCO");
script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("cisco_nxos_version.nasl");
script_require_keys("Host/Cisco/NX-OS/Version", "Host/Cisco/NX-OS/Model", "Host/Cisco/NX-OS/Device");
exit(0);
}
include('audit.inc');
include('cisco_workarounds.inc');
include('ccf.inc');
product_info = cisco::get_product_info(name:'Cisco NX-OS Software');
cbi = '';
if (product_info.device == 'Nexus' && product_info.model =~ '^(36|95)[0-9][0-9]')
cbi = 'CSCvj00330';
else if (product_info.device == 'Nexus' && product_info.model =~ '^(3[05]|90)[0-9][0-9]')
cbi = 'CSCvh24810';
else
audit(AUDIT_HOST_NOT, 'affected');
version_list=make_list(
'7.0(3)I7(2)',
'7.0(3)I7(1)',
'7.0(3)I6(2)',
'7.0(3)I6(1)',
'7.0(3)I5(2)',
'7.0(3)I5(1)',
'7.0(3)I4(8z)',
'7.0(3)I4(8b)',
'7.0(3)I4(8a)',
'7.0(3)I4(8)',
'7.0(3)I4(7)',
'7.0(3)I4(6)',
'7.0(3)I4(5)',
'7.0(3)I4(4)',
'7.0(3)I4(3)',
'7.0(3)I4(2)',
'7.0(3)I4(1)',
'7.0(3)I3(1)',
'7.0(3)I2(5)',
'7.0(3)I2(4)',
'7.0(3)I2(3)',
'7.0(3)I2(2e)',
'7.0(3)I2(2d)',
'7.0(3)I2(2c)',
'7.0(3)I2(2b)',
'7.0(3)I2(2a)',
'7.0(3)I2(1)',
'7.0(3)I1(3b)',
'7.0(3)I1(3a)',
'7.0(3)I1(3)',
'7.0(3)I1(2)',
'7.0(3)I1(1b)',
'7.0(3)I1(1a)',
'7.0(3)I1(1)',
'7.0(3)F3(4)',
'7.0(3)F3(3c)',
'7.0(3)F3(3a)',
'7.0(3)F3(3)',
'7.0(3)F3(2)',
'7.0(3)F3(1)',
'7.0(3)F2(2)',
'7.0(3)F2(1)',
'7.0(3)F1(1)',
'7.0(2)I2(2c)',
'6.1(2)I3(5b)',
'6.1(2)I3(5a)',
'6.1(2)I3(5)',
'6.1(2)I3(4e)',
'6.1(2)I3(4d)',
'6.1(2)I3(4c)',
'6.1(2)I3(4b)',
'6.1(2)I3(4a)',
'6.1(2)I3(4)',
'6.1(2)I3(3a)',
'6.1(2)I3(3.78)',
'6.1(2)I3(3)',
'6.1(2)I3(2)',
'6.1(2)I3(1)',
'6.1(2)I2(3)',
'6.1(2)I2(2b)',
'6.1(2)I2(2a)',
'6.1(2)I2(2)',
'6.1(2)I2(1)',
'6.1(2)I1(3)',
'6.1(2)I1(1)',
'6.1(2)',
'6.0(2)U6(9)',
'6.0(2)U6(8)',
'6.0(2)U6(7)',
'6.0(2)U6(6)',
'6.0(2)U6(5c)',
'6.0(2)U6(5b)',
'6.0(2)U6(5a)',
'6.0(2)U6(5)',
'6.0(2)U6(4a)',
'6.0(2)U6(4)',
'6.0(2)U6(3a)',
'6.0(2)U6(3)',
'6.0(2)U6(2a)',
'6.0(2)U6(2)',
'6.0(2)U6(1a)',
'6.0(2)U6(10)',
'6.0(2)U6(1)',
'6.0(2)U5(4)',
'6.0(2)U5(3)',
'6.0(2)U5(2)',
'6.0(2)U5(1)',
'6.0(2)U4(4)',
'6.0(2)U4(3)',
'6.0(2)U4(2)',
'6.0(2)U4(1)',
'6.0(2)U3(9)',
'6.0(2)U3(8)',
'6.0(2)U3(7)',
'6.0(2)U3(6)',
'6.0(2)U3(5)',
'6.0(2)U3(4)',
'6.0(2)U3(3)',
'6.0(2)U3(2)',
'6.0(2)U3(1)',
'6.0(2)U2(6)',
'6.0(2)U2(5)',
'6.0(2)U2(4)',
'6.0(2)U2(3)',
'6.0(2)U2(2)',
'6.0(2)U2(1)',
'6.0(2)U1(4)',
'6.0(2)U1(3)',
'6.0(2)U1(2)',
'6.0(2)U1(1a)',
'6.0(2)U1(1)',
'5.0(3)U5(1j)',
'5.0(3)U5(1i)',
'5.0(3)U5(1h)',
'5.0(3)U5(1g)',
'5.0(3)U5(1f)',
'5.0(3)U5(1e)',
'5.0(3)U5(1d)',
'5.0(3)U5(1c)',
'5.0(3)U5(1b)',
'5.0(3)U5(1a)',
'5.0(3)U5(1)',
'5.0(3)U4(1)',
'5.0(3)U3(2b)',
'5.0(3)U3(2a)',
'5.0(3)U3(2)',
'5.0(3)U3(1)',
'5.0(3)U2(2d)',
'5.0(3)U2(2c)',
'5.0(3)U2(2b)',
'5.0(3)U2(2a)',
'5.0(3)U2(2)',
'5.0(3)U2(1)',
'5.0(3)U1(2a)',
'5.0(3)U1(2)',
'5.0(3)U1(1d)',
'5.0(3)U1(1c)',
'5.0(3)U1(1b)',
'5.0(3)U1(1a)',
'5.0(3)U1(1)'
);
workarounds = make_list(CISCO_WORKAROUNDS['no workarounds']);
workaround_params = make_list();
reporting = make_array(
'port' , 0,
'severity' , SECURITY_WARNING,
'version' , product_info['version'],
'bug_id' , cbi
);
cisco::check_and_report(product_info:product_info, workarounds:workarounds, workaround_params:workaround_params, reporting:reporting, vuln_versions:version_list);
4.6 Medium
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:P/A:P
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
0.0004 Low
EPSS
Percentile
5.1%