Detections
Analytics

Cisco NX-OS Software Bash Shell Role-Based Access Control Bypass Privilege Escalation Vulnerability

high Nessus Plugin ID 126509

Language:

Synopsis

The remote device is missing a vendor-supplied security patch

Description

According to its self-reported version, a bash shell implementation for Cisco NX-OS software is affected access control bypass privilege vulnerability. An authenticated local attacker can escalate their privilege level by executing commands authorized to other user roles.

Solution

Upgrade to the relevant fixed version referenced in Cisco bug IDs CSCvj59431, CSCvj59446, CSCvk52940, CSCvk52941

See Also

http://www.nessus.org/u?b371e68a

http://tools.cisco.com/security/center/viewErp.x?alertId=ERP-70757

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvj59431

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvj59446

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvk52940

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvk52941

Plugin Details

Severity: High

ID: 126509

File Name: cisco-sa-20190306-nx-os-bash-escal.nasl

Version: 1.6

Type: combined

Family: CISCO

Published: 7/5/2019

Updated: 12/20/2019

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2019-1593

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:cisco:nx-os

Required KB Items: Host/Cisco/NX-OS/Version, Host/Cisco/NX-OS/Model, Host/Cisco/NX-OS/Device

Exploit Ease: No known exploits are available

Patch Publication Date: 3/6/2019

Vulnerability Publication Date: 3/6/2019

Reference Information

CVE: CVE-2019-1593

BID: 107324