Cisco Unified Computing System Unrestricted Upload of File with Dangerous Type (CVE-2017-12332)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(502783);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/10/16");

  script_cve_id("CVE-2017-12332");

  script_name(english:"Cisco Unified Computing System Unrestricted Upload of File with Dangerous Type (CVE-2017-12332)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability in Cisco NX-OS System Software patch installation
could allow an authenticated, local attacker to write a file to
arbitrary locations. The vulnerability is due to insufficient
restrictions in the patch installation process. An attacker could
exploit this vulnerability by installing a crafted patch image on an
affected device. The vulnerable operation occurs prior to patch
activation. An exploit could allow the attacker to write arbitrary
files on an affected system as root. The attacker would need valid
administrator credentials to perform this exploit. This vulnerability
affects the following products running Cisco NX-OS System Software:
Multilayer Director Switches, Nexus 2000 Series Fabric Extenders,
Nexus 5000 Series Switches, Nexus 5500 Platform Switches, Nexus 5600
Platform Switches, Nexus 6000 Series Switches, Nexus 7000 Series
Switches, Nexus 7700 Series Switches, Unified Computing System
Manager. Cisco Bug IDs: CSCvf16513, CSCvf23794, CSCvf23832.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/bid/102160");
  script_set_attribute(attribute:"see_also", value:"http://www.securitytracker.com/id/1039931");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171129-nxos1
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e199e2d0");
  script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/bid/102160");
  script_set_attribute(attribute:"see_also", value:"http://www.securitytracker.com/id/1039931");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171129-nxos1
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e199e2d0");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-12332");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_cwe_id(434);

  script_set_attribute(attribute:"vuln_publication_date", value:"2017/11/30");
  script_set_attribute(attribute:"patch_publication_date", value:"2017/11/30");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/12/04");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nexus_5000_series_switches");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nexus_7000_series_switches");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2024-2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Cisco");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Cisco');

var asset = tenable_ot::assets::get(vendor:'Cisco');

var vuln_cpes = {
    "cpe:/o:cisco:nexus_7000_series_switches" :
        {"versionEndIncluding" : "8.1%281%29", "versionStartIncluding" : "8.1%281%29", "family" : "NXOS"},
    "cpe:/o:cisco:nexus_5000_series_switches" :
        {"versionEndIncluding" : "8.1%280%29BD%280.20%29", "versionStartIncluding" : "8.1%280%29BD%280.20%29", "family" : "NXOS"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);