Cisco NX-OS Software Remote Management Memory Leak Denial of Service (CVE-2019-1965)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(501296);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2023/07/26");

  script_cve_id("CVE-2019-1965");

  script_name(english:"Cisco NX-OS Software Remote Management Memory Leak Denial of Service (CVE-2019-1965)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability in the Virtual Shell (VSH) session management for
Cisco NX-OS Software could allow an authenticated, remote attacker to
cause a VSH process to fail to delete upon termination. This can lead
to a build-up of VSH processes that overtime can deplete system
memory. When there is no system memory available, this can cause
unexpected system behaviors and crashes. The vulnerability is due to
the VSH process not being properly deleted when a remote management
connection to the device is disconnected. An attacker could exploit
this vulnerability by repeatedly performing a remote management
connection to the device and terminating the connection in an
unexpected manner. A successful exploit could allow the attacker to
cause the VSH processes to fail to delete, which can lead to a system-
wide denial of service (DoS) condition. The attacker must have valid
user credentials to log in to the device using the remote management
connection.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190828-nxos-memleak-dos
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?169b4cec");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-1965");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_cwe_id(772);

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/08/28");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/08/28");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/07/25");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nx-os:3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nx-os:4");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nx-os:6");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nx-os:7");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nx-os:8");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nx-os:9");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Cisco");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Cisco');

var asset = tenable_ot::assets::get(vendor:'Cisco');

var vuln_cpes = {
    "cpe:/o:cisco:nx-os:6.2%2829%29" :
        {"versionEndExcluding" : "6.2%2829%29", "versionStartIncluding" : "5.2", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:8.4" :
        {"versionEndExcluding" : "8.4", "versionStartIncluding" : "7.3", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:9.2" :
        {"versionEndExcluding" : "9.2", "versionStartIncluding" : "7.0%283%29f", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:7.1%285%29n1%281b%29" :
        {"versionEndExcluding" : "7.1%285%29n1%281b%29", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:7.3%285%29n1%281%29" :
        {"versionEndExcluding" : "7.3%285%29n1%281%29", "versionStartIncluding" : "7.3", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:6.2%2822%29" :
        {"versionEndExcluding" : "6.2%2822%29", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:7.3%284%29d1%281%29" :
        {"versionEndExcluding" : "7.3%284%29d1%281%29", "versionStartIncluding" : "7.2", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:8.2%283%29" :
        {"versionEndExcluding" : "8.2%283%29", "versionStartIncluding" : "8.0", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:7.0%283%29i4%289%29" :
        {"versionEndExcluding" : "7.0%283%29i4%289%29", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:7.0%283%29i7%284%29" :
        {"versionEndExcluding" : "7.0%283%29i7%284%29", "versionStartIncluding" : "7.0%283%29i7", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:7.0%283%29i7%286%29" :
        {"versionEndExcluding" : "7.0%283%29i7%286%29", "versionStartIncluding" : "7.0%283%29i7", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:9.2%283%29" :
        {"versionEndExcluding" : "9.2%283%29", "versionStartIncluding" : "9.2", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:3.2%283k%29" :
        {"versionEndExcluding" : "3.2%283k%29", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:4.0%282e%29" :
        {"versionEndExcluding" : "4.0%282e%29", "versionStartIncluding" : "4.0", "family" : "NXOS"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);