Cisco FXOS/UCS Fabric Interconnect Software CLI Parser input validation

Summaryinfo

A vulnerability marked as problematic has been reported in Cisco FXOS and UCS Fabric Interconnect Software. Affected is an unknown function of the component CLI Parser. This manipulation causes input validation. This vulnerability is tracked as CVE-2018-0302. The attack is restricted to local execution. No exploit exists.

Detailsinfo

A vulnerability has been found in Cisco FXOS and UCS Fabric Interconnect Software (Virtualization Software) (the affected version is unknown) and classified as problematic. Affected by this vulnerability is an unknown code of the component CLI Parser. The manipulation with an unknown input leads to a input validation vulnerability. The CWE definition for the vulnerability is CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in the CLI parser of Cisco FXOS Software and Cisco UCS Fabric Interconnect Software could allow an authenticated, local attacker to cause a buffer overflow on an affected device. The vulnerability is due to incorrect input validation in the CLI parser subsystem. An attacker could exploit this vulnerability by exceeding the expected length of user input. A successful exploit could allow the attacker to execute arbitrary code with root privileges on the affected system. This vulnerability affects Firepower 4100 Series Next-Generation Firewall, Firepower 9300 Security Appliance, UCS 6100 Series Fabric Interconnects, UCS 6200 Series Fabric Interconnects, UCS 6300 Series Fabric Interconnects. Cisco Bug IDs: CSCvb61099, CSCvb86743.

The bug was discovered 06/20/2018. The weakness was disclosed 06/21/2018 as cisco-sa-20180620-fxos-ace / CSCvb86743 as confirmed advisory (Website). It is possible to read the advisory at tools.cisco.com. This vulnerability is known as CVE-2018-0302 since 11/27/2017. Attacking locally is a requirement. A single authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 02/21/2020).

The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $5k-$25k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entry VDB-119764 is pretty similar. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Virtualization Software

Vendor

• Cisco

Name

• FXOS
• UCS Fabric Interconnect Software

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion