Cisco NX-OS Software Arbitrary File Overwrite (CVE-2019-1729)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(501251);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2023/07/26");

  script_cve_id("CVE-2019-1729");

  script_name(english:"Cisco NX-OS Software Arbitrary File Overwrite (CVE-2019-1729)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability in the CLI implementation of a specific command used
for image maintenance for Cisco NX-OS Software could allow an
authenticated, local attacker to overwrite any file on the file system
including system files. These file overwrites by the attacker are
accomplished at the root privilege level. The vulnerability occurs
because there is no verification of user-input parameters and or
digital-signature verification for image files when using a specific
CLI command. An attacker could exploit this vulnerability by
authenticating to the device and issuing a command at the CLI. Because
an exploit could allow the attacker to overwrite any file on the disk,
including system files, a denial of service (DoS) condition could
occur. The attacker must have valid administrator credentials for the
affected device to exploit this vulnerability.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/bid/108378");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-file-write
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?21a0adf7");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-1729");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_cwe_id(347);

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/05/15");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/05/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/07/25");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nx-os:7");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Cisco");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Cisco');

var asset = tenable_ot::assets::get(vendor:'Cisco');

var vuln_cpes = {
    "cpe:/o:cisco:nx-os:7.0%283%29i4%289%29" :
        {"versionEndExcluding" : "7.0%283%29i4%289%29", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:7.0%283%29i7%284%29" :
        {"versionEndExcluding" : "7.0%283%29i7%284%29", "versionStartIncluding" : "7.0%283%29i7", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:7.0%283%29f3%285%29" :
        {"versionEndExcluding" : "7.0%283%29f3%285%29", "versionStartIncluding" : "7.0%283%29", "family" : "NXOS"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);