Cisco IOS XE Lua Interpreter memory corruption

Summaryinfo

A vulnerability identified as critical has been detected in Cisco IOS XE. Affected by this issue is some unknown functionality of the component Lua Interpreter. Performing a manipulation results in memory corruption. This vulnerability is reported as CVE-2020-3423. The attack requires a local approach. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in Cisco IOS XE (Router Operating System) (affected version not known). This affects some unknown functionality of the component Lua Interpreter. The manipulation with an unknown input leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in the implementation of the Lua interpreter that is integrated in Cisco IOS XE Software could allow an authenticated, local attacker to execute arbitrary code with root privileges on the underlying Linux operating system (OS) of an affected device. The vulnerability is due to insufficient restrictions on Lua function calls within the context of user-supplied Lua scripts. An attacker with valid administrative credentials could exploit this vulnerability by submitting a malicious Lua script. When this file is processed, an exploitable buffer overflow condition could occur. A successful exploit could allow the attacker to execute arbitrary code with root privileges on the underlying Linux OS of the affected device.

The weakness was disclosed 09/24/2020 as cisco-sa-ios-lua-rce-7VeJX4f as confirmed advisory (Website). The advisory is shared at tools.cisco.com. This vulnerability is uniquely identified as CVE-2020-3423 since 12/12/2019. An attack has to be approached locally. A authentication is required for exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/25/2020).

Upgrading eliminates this vulnerability.

The entries VDB-161881, VDB-161880, VDB-161878 and VDB-161876 are pretty similar. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Router Operating System

Vendor

• Cisco

Name

• IOS XE

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion