Cisco NX-OS Software Privilege Escalation (CVE-2019-1604)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(501404);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2023/07/26");

  script_cve_id("CVE-2019-1604");

  script_name(english:"Cisco NX-OS Software Privilege Escalation (CVE-2019-1604)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability in the user account management interface of Cisco NX-
OS Software could allow an authenticated, local attacker to gain
elevated privileges on an affected device. The vulnerability is due to
an incorrect authorization check of user accounts and their associated
Group ID (GID). An attacker could exploit this vulnerability by taking
advantage of a logic error that will permit the use of higher
privileged commands than what is necessarily assigned. A successful
exploit could allow an attacker to execute commands with elevated
privileges on the underlying Linux shell of an affected device. Nexus
7000 and 7700 Series Switches are affected in versions prior to
6.2(22), 8.2(3), and 8.3(2). Nexus 3000 Series Switches are affected
in versions prior to 7.0(3)I7(4). Nexus 3500 Platform Switches are
affected in versions prior to 7.0(3)I7(4). Nexus 3600 Platform
Switches are affected in versions prior to 7.0(3)F3(5). Nexus 9000
Series Switches-Standalone are affected in versions prior to
7.0(3)I7(4). Nexus 9500 R-Series Line Cards and Fabric Modules are
affected in versions prior to 7.0(3)F3(5).

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/bid/107323");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-nxos-privesca
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2494752e");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-1604");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(863);

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/03/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/03/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/07/25");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nx-os:6");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nx-os:7");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nx-os:8");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Cisco");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Cisco');

var asset = tenable_ot::assets::get(vendor:'Cisco');

var vuln_cpes = {
    "cpe:/o:cisco:nx-os:7.0%283%29i7%284%29" :
        {"versionEndExcluding" : "7.0%283%29i7%284%29", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:7.0%283%29f3%285%29" :
        {"versionEndExcluding" : "7.0%283%29f3%285%29", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:8.3%282%29" :
        {"versionEndExcluding" : "8.3%282%29", "versionStartExcluding" : "8.2%283%29", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:8.2%283%29" :
        {"versionEndExcluding" : "8.2%283%29", "versionStartExcluding" : "6.22%2822%29", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:6.2%2822%29" :
        {"versionEndExcluding" : "6.2%2822%29", "family" : "NXOS"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);