Cisco NX-OS RBAC Command input validation

Summaryinfo

A vulnerability was found in Cisco NX-OS. It has been declared as problematic. This affects an unknown function of the component RBAC. Executing a manipulation as part of Command can lead to input validation. This vulnerability is handled as CVE-2018-0337. It is possible to launch the attack on the local host. There is not any exploit available.

Detailsinfo

A vulnerability has been found in Cisco NX-OS (Router Operating System) (version now known) and classified as problematic. This vulnerability affects some unknown processing of the component RBAC. The manipulation as part of a Command leads to a input validation vulnerability. The CWE definition for the vulnerability is CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

A vulnerability in the role-based access-checking mechanisms of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on an affected device. The vulnerability exists because the affected software lacks proper input and validation checks for certain file systems. An attacker could exploit this vulnerability by issuing crafted commands in the CLI of an affected device. A successful exploit could allow the attacker to cause other users to execute unwanted, arbitrary commands on the affected device. Cisco Bug IDs: CSCvd06339, CSCvd15698, CSCvd36108, CSCvf52921, CSCvf52930, CSCvf52953, CSCvf52976.

The bug was discovered 06/20/2018. The weakness was released 06/21/2018 as cisco-sa-20180620-nxos-rbacces / CSCvf52976 as confirmed advisory (Website). The advisory is shared for download at tools.cisco.com. This vulnerability was named CVE-2018-0337 since 11/27/2017. The attack needs to be approached locally. Required for exploitation is a single authentication. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 02/21/2020).

The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $5k-$25k. The commercial vulnerability scanner Qualys is able to test this issue with plugin 316297 (Cisco NX-OS Software Role-Based Access Arbitrary Command Execution Vulnerability(cisco-sa-20180620-nxos-rbaccess)).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Entries connected to this vulnerability are available at VDB-119775 and VDB-119774. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Router Operating System

Vendor

• Cisco

Name

• NX-OS

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion