Cisco NX-OS Software Bash Shell Privilege Escalation (CVE-2019-1596)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(501284);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2023/07/26");

  script_cve_id("CVE-2019-1596");

  script_name(english:"Cisco NX-OS Software Bash Shell Privilege Escalation (CVE-2019-1596)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability in the Bash shell implementation for Cisco NX-OS
Software could allow an authenticated, local attacker to escalate
their privilege level to root. The attacker must authenticate with
valid user credentials. The vulnerability is due to incorrect
permissions of a system executable. An attacker could exploit this
vulnerability by authenticating to the device and entering a crafted
command at the Bash prompt. A successful exploit could allow the
attacker to escalate their privilege level to root. Nexus 3000 Series
Switches are affected in versions prior to 7.0(3)I7(4). Nexus 3500
Platform Switches are affected in versions prior to 7.0(3)I7(4). Nexus
3600 Platform Switches are affected in versions prior to 7.0(3)F3(5).
Nexus 9000 Series Switches in Standalone NX-OS Mode are affected in
versions prior to 7.0(3)I7(4). Nexus 9500 R-Series Line Cards and
Fabric Modules are affected in versions prior to 7.0(3)F3(5).

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/bid/107340");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-nxos-pe
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2e5e4b66");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-1596");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(732);

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/03/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/03/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/07/25");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nx-os:7");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Cisco");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Cisco');

var asset = tenable_ot::assets::get(vendor:'Cisco');

var vuln_cpes = {
    "cpe:/o:cisco:nx-os:7.0%283%29i4%289%29" :
        {"versionEndExcluding" : "7.0%283%29i4%289%29", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:7.0%283%29i7%284%29" :
        {"versionEndExcluding" : "7.0%283%29i7%284%29", "versionStartIncluding" : "7.0%283%29i5", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:7.0%283%29f3%285%29" :
        {"versionEndExcluding" : "7.0%283%29f3%285%29", "versionStartIncluding" : "7.0%283%29f3%281%29", "family" : "NXOS"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);