Cisco NX-OS Permissions, Privileges, and Access Controls (CVE-2015-4234)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(502762);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/12/05");

  script_cve_id("CVE-2015-4234");

  script_name(english:"Cisco NX-OS Permissions, Privileges, and Access Controls (CVE-2015-4234)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"Cisco NX-OS 6.0(2) and 6.2(2) on Nexus devices has an improper OS
configuration, which allows local users to obtain root access via
unspecified input to the Python interpreter, aka Bug IDs CSCun02887,
CSCur00115, and CSCur00127.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"http://tools.cisco.com/security/center/viewAlert.x?alertId=39571");
  script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/bid/75502");
  script_set_attribute(attribute:"see_also", value:"http://www.securitytracker.com/id/1032765");
  script_set_attribute(attribute:"see_also", value:"http://tools.cisco.com/security/center/viewAlert.x?alertId=39571");
  script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/bid/75502");
  script_set_attribute(attribute:"see_also", value:"http://www.securitytracker.com/id/1032765");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2015-4234");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(264);

  script_set_attribute(attribute:"vuln_publication_date", value:"2015/07/03");
  script_set_attribute(attribute:"patch_publication_date", value:"2015/07/03");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/12/04");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nx-os:6.0%282%29");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nx-os:6.2%282%29");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Cisco");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Cisco');

var asset = tenable_ot::assets::get(vendor:'Cisco');

var vuln_cpes = {
    "cpe:/o:cisco:nx-os:6.0%282%29" :
        {"versionEndIncluding" : "6.0%282%29", "versionStartIncluding" : "6.0%282%29", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:6.2%282%29" :
        {"versionEndIncluding" : "6.2%282%29", "versionStartIncluding" : "6.2%282%29", "family" : "NXOS"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);