Cisco NX-OS CLI memory corruption

Summaryinfo

A vulnerability classified as critical has been found in Cisco NX-OS. This vulnerability affects unknown code of the component CLI. This manipulation causes memory corruption. This vulnerability is tracked as CVE-2019-1768. The attack is restricted to local execution. No exploit exists.

Detailsinfo

A vulnerability classified as critical was found in Cisco NX-OS (Router Operating System) (version now known). Affected by this vulnerability is some unknown processing of the component CLI. The manipulation with an unknown input leads to a memory corruption vulnerability. The CWE definition for the vulnerability is CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in the implementation of a specific CLI command for Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to cause a buffer overflow condition or perform command injection. This could allow the attacker to execute arbitrary commands with elevated privileges on the underlying operating system of an affected device. The vulnerability is due to insufficient validation of arguments passed to a certain CLI command. An attacker could exploit this vulnerability by including malicious input as the argument of the affected CLI command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges. An attacker would need valid administrator credentials to exploit these vulnerabilities.

The bug was discovered 05/15/2019. The weakness was disclosed 05/16/2019 with Cisco as cisco-sa-20190515-nxos-overflo as confirmed advisory (Website). It is possible to read the advisory at tools.cisco.com. This vulnerability is known as CVE-2019-1768 since 12/06/2018. Attacking locally is a requirement. Required for exploitation is a single authentication. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 09/21/2023).

The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $5k-$25k. The commercial vulnerability scanner Qualys is able to test this issue with plugin 316467 (Cisco NX-OS Software Buffer Overflow and Command Injection Vulnerabilities(cisco-sa-20190515-nxos-overflow-inj)).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 108386†). The entry VDB-135079 is pretty similar. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• Cisco

Name

• NX-OS

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion