Cisco FXOS Software and UCS Fabric Interconnect Arbitrary Code Execution (CVE-2018-0302)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(501310);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2023/07/26");

  script_cve_id("CVE-2018-0302");

  script_name(english:"Cisco FXOS Software and UCS Fabric Interconnect Arbitrary Code Execution (CVE-2018-0302)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability in the CLI parser of Cisco FXOS Software and Cisco UCS
Fabric Interconnect Software could allow an authenticated, local
attacker to cause a buffer overflow on an affected device. The
vulnerability is due to incorrect input validation in the CLI parser
subsystem. An attacker could exploit this vulnerability by exceeding
the expected length of user input. A successful exploit could allow
the attacker to execute arbitrary code with root privileges on the
affected system. This vulnerability affects Firepower 4100 Series
Next-Generation Firewall, Firepower 9300 Security Appliance, UCS 6100
Series Fabric Interconnects, UCS 6200 Series Fabric Interconnects, UCS
6300 Series Fabric Interconnects. Cisco Bug IDs: CSCvb61099,
CSCvb86743.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180620-fxos-ace
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c7d0305f");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-0302");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_cwe_id(119);

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/06/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/06/21");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/07/25");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nx-os:3.1%281k%29a");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Cisco");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Cisco');

var asset = tenable_ot::assets::get(vendor:'Cisco');

var vuln_cpes = {
    "cpe:/o:cisco:nx-os:3.1%281k%29a" :
        {"versionEndIncluding" : "3.1%281k%29a", "versionStartIncluding" : "3.1%281k%29a", "family" : "NXOS"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);