Cisco IOS XE Software Path Traversal Vulnerability

2019-10-03T00:00:00
ID CISCO-SA-20190925-IOSXE-DT.NASL
Type nessus
Reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
Modified 2019-10-03T00:00:00

Description

According to its self-reported version, Cisco IOS XE Software is affected by a vulnerability in the Guest Shell. The vulnerability could allow an authenticated, local attacker to perform directory traversal on the base Linux operating system of Cisco IOS XE Software. The vulnerability is due to incomplete validation of certain commands. An attacker could exploit this vulnerability by first accessing the Guest Shell and then entering specific commands. A successful exploit could allow the attacker to execute arbitrary code on the base Linux operating system.

Please see the included Cisco BIDs and Cisco Security Advisory for more information

                                        
                                            #TRUSTED 5ade1460961f1330401f3ae74cdb8d3fc5882b410350fe29e7866d0e15c87beab5ca7f165c16a48f227b6f8d7f2e71b44820a920a6461345ba0df1c0b57c97c6b34ddeb9d4ecb8043766b33335abf5d890d766c36db2c3d012139f2fd60d634087fab17f210072af77b7c149a1949c62feb37fa77b47e73de7ac953cef55fcc9ca1fddb6d39d28b15ea185e18820fba682e378e3f2bd8a6be71e2c04fba79d32aa03297534a8de71158d6ee57df991695529c44a560ec2bf753365f0b1e1382fc3c287919b02bf39993e2656779865d4efa604ca7fa3b85020fc787c1f2d600ff890a569c2c412cb9aa26ab3e18a44d17d918b753693fca0f6b434de6f66ec5d26867a36c63ffea2b7833b27740bbcf5399d094dcd16f497890901f5112e25024f1c422f2637c1ef84adff70f96f9c8fae548b92f664a7eaa019c98bedcfe8ec0054c42a664d8f8566dbcb85022675657994d8b822af870684e559214b1b55a7f01896d1c5ac4f180b384ae4e88ad1d9f8c3f247cbccb469ef8cb89c2b217f6df3e9214d3300d9402a2545502fdaef6445723b135fb906d0d6b56745d6a587d4d3ef6bfcfaa912cfa9f34b2a4ecc2507c519ee60760ea09dba04ce04b94c20be734c48b5831e1f477e2562bd557c26a763650877dfea5c0f63e0cf39b1aa5e3780a77043a73c64f5ca469d2a7360d14c88a180cf1b10dcc472d9799a542562f2
#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(129531);
  script_version("1.8");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/08");

  script_cve_id("CVE-2019-12666");
  script_xref(name:"CISCO-BUG-ID", value:"CSCvm24705");
  script_xref(name:"CISCO-SA", value:"cisco-sa-20190925-dt");
  script_xref(name:"IAVA", value:"2019-A-0354");
  script_xref(name:"IAVA", value:"2019-A-0352-S");

  script_name(english:"Cisco IOS XE Software Path Traversal Vulnerability");
  script_summary(english:"Checks the version of Cisco IOS XE Software");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco IOS XE Software is affected by a vulnerability in the Guest Shell. The
vulnerability could allow an authenticated, local attacker to perform directory traversal on the base Linux operating
system of Cisco IOS XE Software. The vulnerability is due to incomplete validation of certain commands. An attacker
could exploit this vulnerability by first accessing the Guest Shell and then entering specific commands. A successful
exploit could allow the attacker to execute arbitrary code on the base Linux operating system.

Please see the included Cisco BIDs and Cisco Security Advisory for more information");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-dt
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a86431af");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvm24705");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCvm24705");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-12666");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_cwe_id(22);

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/09/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/09/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/10/03");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ios_xe");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ios_xe_version.nasl");
  script_require_keys("Host/Cisco/IOS-XE/Version");

  exit(0);
}

include('audit.inc');
include('cisco_workarounds.inc');
include('ccf.inc');

product_info = cisco::get_product_info(name:'Cisco IOS XE Software');

version_list=make_list(
  '16.9.2a',
  '16.9.2',
  '16.9.1s',
  '16.9.1d',
  '16.9.1c',
  '16.9.1b',
  '16.9.1a',
  '16.9.1',
  '16.8.2',
  '16.8.1s',
  '16.8.1e',
  '16.8.1d',
  '16.8.1c',
  '16.8.1b',
  '16.8.1a',
  '16.8.1',
  '16.7.3',
  '16.7.2',
  '16.7.1b',
  '16.7.1a',
  '16.7.1',
  '16.6.4s',
  '16.6.4a',
  '16.6.4',
  '16.6.3',
  '16.6.2',
  '16.6.1',
  '16.5.3',
  '16.5.2',
  '16.5.1b',
  '16.5.1a',
  '16.5.1',
  '16.4.3',
  '16.4.2',
  '16.4.1'
);

workarounds = make_list(CISCO_WORKAROUNDS['guestshell_iosxe']);
workaround_params = make_list();

reporting = make_array(
  'port'     , 0,
  'severity' , SECURITY_HOLE,
  'version'  , product_info['version'],
  'bug_id'   , 'CSCvm24705',
  'cmds'     , make_list('guestshell')
);

cisco::check_and_report(
  product_info:product_info,
  workarounds:workarounds,
  workaround_params:workaround_params,
  reporting:reporting,
  vuln_versions:version_list
);