Vulnerability-Lookup

BDU:2019-01982

Vulnerability from fstec - Published: 15.05.2019

Title

Уязвимость сетевой операционной системы NX-OS, связанная с некорректной проверкой криптографической подписи, позволяющая нарушителю установить вредоносное программное обеспечение на уязвимом устройстве

Description

Уязвимость сетевой операционной системы NX-OS связана с некорректной проверкой криптографической подписи. Эксплуатация уязвимости может позволить нарушителю установить вредоносное программное обеспечение на уязвимом устройстве

Severity ?


                    
                      AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Vendor

Cisco Systems Inc.

Software Name

NX-OS

Software Version

7.0(3) (NX-OS), 7.2(0)zz(99.1) (NX-OS), 7.1(1)N1(1) (NX-OS), 7.0(1)N1(1) (NX-OS), 7.0(1)N1(3) (NX-OS), 7.0(4)N1(1) (NX-OS), 7.0(3)i3(1) (NX-OS), 7.2(1)D1(1) (NX-OS), 7.3(1)N1(0.1) (NX-OS), 7.0(0)N1(1) (NX-OS), 7.0(2)I2(2c) (NX-OS), 7.0(2)N1(1) (NX-OS), 7.0(2)N1(1a) (NX-OS), 7.0(3)F1(1) (NX-OS), 7.0(3)F2(1) (NX-OS), 7.0(3)F2(2) (NX-OS), 7.0(3)F3(1) (NX-OS), 7.0(3)F3(2) (NX-OS), 7.0(3)F3(3) (NX-OS), 7.0(3)F3(3a) (NX-OS), 7.0(3)F3(4) (NX-OS), 7.0(3)F3(3c) (NX-OS), 7.0(3)F3(3b) (NX-OS), 7.0(3)F3(5) (NX-OS), 7.0(3)I1(1) (NX-OS), 7.0(3)I1(1a) (NX-OS), 7.0(3)I1(1b) (NX-OS), 7.0(3)I1(2) (NX-OS), 7.0(3)I1(3) (NX-OS), 7.0(3)I1(3a) (NX-OS), 7.0(3)I1(3b) (NX-OS), 7.0(3)I2(2a) (NX-OS), 7.0(3)I2(2b) (NX-OS), 7.0(3)I2(2c) (NX-OS), 7.0(3)I2(2d) (NX-OS), 7.0(3)I2(2e) (NX-OS), 7.0(3)I2(3) (NX-OS), 7.0(3)I2(4) (NX-OS), 7.0(3)I2(5) (NX-OS), 7.0(3)I2(1) (NX-OS), 7.0(3)I2(1a) (NX-OS), 7.0(3)I2(2) (NX-OS), 7.0(3)I4(1) (NX-OS), 7.0(3)I4(2) (NX-OS), 7.0(3)I4(3) (NX-OS), 7.0(3)I4(4) (NX-OS), 7.0(3)I4(5) (NX-OS), 7.0(3)I4(6) (NX-OS), 7.0(3)I4(7) (NX-OS), 7.0(3)I4(8) (NX-OS), 7.0(3)I4(8a) (NX-OS), 7.0(3)I4(8b) (NX-OS), 7.0(3)I4(8z) (NX-OS), 7.0(3)I7(5a) (NX-OS), 7.0(3)I5(1) (NX-OS), 7.0(3)I5(2) (NX-OS), 7.0(3)I6(1) (NX-OS), 7.0(3)I6(2) (NX-OS), 7.0(3)I7(1) (NX-OS), 7.0(3)I7(2) (NX-OS), 7.0(3)I7(3) (NX-OS), 7.0(3)I7(4) (NX-OS), 7.0(3)I7(5) (NX-OS), 7.0(3)IX1(2) (NX-OS), 7.0(3)IX1(2a) (NX-OS), 7.0(3)N1(1) (NX-OS), 7.0(4)N1(1a) (NX-OS), 7.0(5)N1(1) (NX-OS), 7.0(5)N1(1a) (NX-OS), 7.0(6)N1(1) (NX-OS), 7.0(6)N1(4s) (NX-OS), 7.0(6)N1(3s) (NX-OS), 7.0(6)N1(2s) (NX-OS), 7.0(6)N1(1c) (NX-OS), 7.0(7)N1(1) (NX-OS), 7.0(7)N1(1b) (NX-OS), 7.0(7)N1(1a) (NX-OS), 7.0(8)N1(1) (NX-OS), 7.0(8)N1(1a) (NX-OS), 7.1(0)N1(1a) (NX-OS), 7.1(0)N1(1b) (NX-OS), 7.1(0)N1(2) (NX-OS), 7.1(0)N1(1) (NX-OS), 7.1(1)N1(1a) (NX-OS), 7.1(2)N1(1) (NX-OS), 7.1(2)N1(1a) (NX-OS), 7.1(3)N1(1) (NX-OS), 7.1(3)N1(2) (NX-OS), 7.1(3)N1(2.1) (NX-OS), 7.1(3)N1(3.12) (NX-OS), 7.1(3)N1(5) (NX-OS), 7.1(3)N1(4) (NX-OS), 7.1(3)N1(3) (NX-OS), 7.1(3)N1(2a) (NX-OS), 7.1(3)N1(1b) (NX-OS), 7.1(4)N1(1) (NX-OS), 7.1(4)N1(1d) (NX-OS), 7.1(4)N1(1c) (NX-OS), 7.1(4)N1(1a) (NX-OS), 7.1(4)N1(1e) (NX-OS), 7.1(5)N1(1) (NX-OS), 7.1(5)N1(1b) (NX-OS), 7.2(0)D1(0.437) (NX-OS), 7.2(0)D1(1) (NX-OS), 7.2(0)N1(1) (NX-OS), 7.2(1)N1(1) (NX-OS), 7.2(2)D1(2) (NX-OS), 7.2(2)D1(1) (NX-OS), 7.3(0.2) (NX-OS), 7.3(0)D1(1) (NX-OS), 7.3(0)DX(1) (NX-OS), 7.3(0)DY(1) (NX-OS), 7.3(0)N1(1) (NX-OS), 7.3(0)N1(1b) (NX-OS), 7.3(0)N1(1a) (NX-OS), 7.3(1)D1(1B) (NX-OS), 7.3(1)D1(1) (NX-OS), 7.3(1)DY(1) (NX-OS), 7.3(1)N1(1) (NX-OS), 7.3(2)D1(1A) (NX-OS), 7.3(2)D1(1) (NX-OS), 7.3(2)D1(2) (NX-OS), 7.3(2)D1(3) (NX-OS), 7.3(2)D1(3a) (NX-OS), 7.3(2)N1(0.296) (NX-OS), 7.3(2)N1(1) (NX-OS), 8.2(1) (NX-OS), 8.2(2) (NX-OS)

Possible Mitigations

Использование рекомендаций: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-spsv

Reference

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-spsv https://nvd.nist.gov/vuln/detail/CVE-2019-1808

CWE

CWE-347

JSON

To clipboard

{
  "CVSS 2.0": "AV:L/AC:L/Au:S/C:C/I:C/A:C",
  "CVSS 3.0": "AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Cisco Systems Inc.",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "7.0(3) (NX-OS), 7.2(0)zz(99.1) (NX-OS), 7.1(1)N1(1) (NX-OS), 7.0(1)N1(1) (NX-OS), 7.0(1)N1(3) (NX-OS), 7.0(4)N1(1) (NX-OS), 7.0(3)i3(1) (NX-OS), 7.2(1)D1(1) (NX-OS), 7.3(1)N1(0.1) (NX-OS), 7.0(0)N1(1) (NX-OS), 7.0(2)I2(2c) (NX-OS), 7.0(2)N1(1) (NX-OS), 7.0(2)N1(1a) (NX-OS), 7.0(3)F1(1) (NX-OS), 7.0(3)F2(1) (NX-OS), 7.0(3)F2(2) (NX-OS), 7.0(3)F3(1) (NX-OS), 7.0(3)F3(2) (NX-OS), 7.0(3)F3(3) (NX-OS), 7.0(3)F3(3a) (NX-OS), 7.0(3)F3(4) (NX-OS), 7.0(3)F3(3c) (NX-OS), 7.0(3)F3(3b) (NX-OS), 7.0(3)F3(5) (NX-OS), 7.0(3)I1(1) (NX-OS), 7.0(3)I1(1a) (NX-OS), 7.0(3)I1(1b) (NX-OS), 7.0(3)I1(2) (NX-OS), 7.0(3)I1(3) (NX-OS), 7.0(3)I1(3a) (NX-OS), 7.0(3)I1(3b) (NX-OS), 7.0(3)I2(2a) (NX-OS), 7.0(3)I2(2b) (NX-OS), 7.0(3)I2(2c) (NX-OS), 7.0(3)I2(2d) (NX-OS), 7.0(3)I2(2e) (NX-OS), 7.0(3)I2(3) (NX-OS), 7.0(3)I2(4) (NX-OS), 7.0(3)I2(5) (NX-OS), 7.0(3)I2(1) (NX-OS), 7.0(3)I2(1a) (NX-OS), 7.0(3)I2(2) (NX-OS), 7.0(3)I4(1) (NX-OS), 7.0(3)I4(2) (NX-OS), 7.0(3)I4(3) (NX-OS), 7.0(3)I4(4) (NX-OS), 7.0(3)I4(5) (NX-OS), 7.0(3)I4(6) (NX-OS), 7.0(3)I4(7) (NX-OS), 7.0(3)I4(8) (NX-OS), 7.0(3)I4(8a) (NX-OS), 7.0(3)I4(8b) (NX-OS), 7.0(3)I4(8z) (NX-OS), 7.0(3)I7(5a) (NX-OS), 7.0(3)I5(1) (NX-OS), 7.0(3)I5(2) (NX-OS), 7.0(3)I6(1) (NX-OS), 7.0(3)I6(2) (NX-OS), 7.0(3)I7(1) (NX-OS), 7.0(3)I7(2) (NX-OS), 7.0(3)I7(3) (NX-OS), 7.0(3)I7(4) (NX-OS), 7.0(3)I7(5) (NX-OS), 7.0(3)IX1(2) (NX-OS), 7.0(3)IX1(2a) (NX-OS), 7.0(3)N1(1) (NX-OS), 7.0(4)N1(1a) (NX-OS), 7.0(5)N1(1) (NX-OS), 7.0(5)N1(1a) (NX-OS), 7.0(6)N1(1) (NX-OS), 7.0(6)N1(4s) (NX-OS), 7.0(6)N1(3s) (NX-OS), 7.0(6)N1(2s) (NX-OS), 7.0(6)N1(1c) (NX-OS), 7.0(7)N1(1) (NX-OS), 7.0(7)N1(1b) (NX-OS), 7.0(7)N1(1a) (NX-OS), 7.0(8)N1(1) (NX-OS), 7.0(8)N1(1a) (NX-OS), 7.1(0)N1(1a) (NX-OS), 7.1(0)N1(1b) (NX-OS), 7.1(0)N1(2) (NX-OS), 7.1(0)N1(1) (NX-OS), 7.1(1)N1(1a) (NX-OS), 7.1(2)N1(1) (NX-OS), 7.1(2)N1(1a) (NX-OS), 7.1(3)N1(1) (NX-OS), 7.1(3)N1(2) (NX-OS), 7.1(3)N1(2.1) (NX-OS), 7.1(3)N1(3.12) (NX-OS), 7.1(3)N1(5) (NX-OS), 7.1(3)N1(4) (NX-OS), 7.1(3)N1(3) (NX-OS), 7.1(3)N1(2a) (NX-OS), 7.1(3)N1(1b) (NX-OS), 7.1(4)N1(1) (NX-OS), 7.1(4)N1(1d) (NX-OS), 7.1(4)N1(1c) (NX-OS), 7.1(4)N1(1a) (NX-OS), 7.1(4)N1(1e) (NX-OS), 7.1(5)N1(1) (NX-OS), 7.1(5)N1(1b) (NX-OS), 7.2(0)D1(0.437) (NX-OS), 7.2(0)D1(1) (NX-OS), 7.2(0)N1(1) (NX-OS), 7.2(1)N1(1) (NX-OS), 7.2(2)D1(2) (NX-OS), 7.2(2)D1(1) (NX-OS), 7.3(0.2) (NX-OS), 7.3(0)D1(1) (NX-OS), 7.3(0)DX(1) (NX-OS), 7.3(0)DY(1) (NX-OS), 7.3(0)N1(1) (NX-OS), 7.3(0)N1(1b) (NX-OS), 7.3(0)N1(1a) (NX-OS), 7.3(1)D1(1B) (NX-OS), 7.3(1)D1(1) (NX-OS), 7.3(1)DY(1) (NX-OS), 7.3(1)N1(1) (NX-OS), 7.3(2)D1(1A) (NX-OS), 7.3(2)D1(1) (NX-OS), 7.3(2)D1(2) (NX-OS), 7.3(2)D1(3) (NX-OS), 7.3(2)D1(3a) (NX-OS), 7.3(2)N1(0.296) (NX-OS), 7.3(2)N1(1) (NX-OS), 8.2(1) (NX-OS), 8.2(2) (NX-OS)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439: \nhttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-spsv",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "15.05.2019",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "23.03.2021",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "06.06.2019",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2019-01982",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2019-1808",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "NX-OS",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "Cisco Systems Inc. - - Cisco MDS 9700 Series Multilayer Directors, Cisco Systems Inc. - - Cisco Nexus 7000 Series, Cisco Systems Inc. - - Cisco Nexus 7700 Series",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b\u00a0NX-OS, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u043e\u0439 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u0430\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 (CWE-347)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b\u00a0NX-OS \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u043e\u0439 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": "-",
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041f\u043e\u0434\u043c\u0435\u043d\u0430 \u043f\u0440\u0438 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-spsv\nhttps://nvd.nist.gov/vuln/detail/CVE-2019-1808",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-347",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,8)\n\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,7)"
}

CVE-2019-1808 (GCVE-0-2019-1808)

Vulnerability from cvelistv5 – Published: 2019-05-15 22:15 – Updated: 2024-11-20 17:19

Title

Cisco MDS 9700 Series Multilayer Directors and Nexus 7000/7700 Series Switches Software Patch Signature Verification Vulnerability

Summary

A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level credentials to install a malicious software patch on an affected device. The vulnerability is due to improper verification of digital signatures for patch images. An attacker could exploit this vulnerability by loading an unsigned software patch on an affected device. A successful exploit could allow the attacker to boot a malicious software patch image.

Severity ?

6.7 (Medium)


                        
                          CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-347

Assigner

cisco

References

URL

Tags

	https://tools.cisco.com/security/center/content/C…	vendor-advisoryx_refsource_CISCO
	http://www.securityfocus.com/bid/108367	vdb-entryx_refsource_BID

Impacted products

	Vendor	Product	Version
	Cisco	Cisco NX-OS Software	Affected: unspecified , < 8.3(1) (custom)

Date Public ?

2019-05-15 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T18:28:42.844Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20190515 Cisco MDS 9700 Series Multilayer Directors and Nexus 7000/7700 Series Switches Software Patch Signature Verification Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-spsv"
          },
          {
            "name": "108367",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/108367"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2019-1808",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-20T16:54:31.235511Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-20T17:19:27.801Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Cisco NX-OS Software",
          "vendor": "Cisco",
          "versions": [
            {
              "lessThan": "8.3(1)",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2019-05-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level credentials to install a malicious software patch on an affected device. The vulnerability is due to improper verification of digital signatures for patch images. An attacker could exploit this vulnerability by loading an unsigned software patch on an affected device. A successful exploit could allow the attacker to boot a malicious software patch image."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-347",
              "description": "CWE-347",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-05-17T11:06:04.000Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "20190515 Cisco MDS 9700 Series Multilayer Directors and Nexus 7000/7700 Series Switches Software Patch Signature Verification Vulnerability",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-spsv"
        },
        {
          "name": "108367",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/108367"
        }
      ],
      "source": {
        "advisory": "cisco-sa-20190515-nxos-spsv",
        "defect": [
          [
            "CSCvi42248"
          ]
        ],
        "discovery": "INTERNAL"
      },
      "title": "Cisco MDS 9700 Series Multilayer Directors and Nexus 7000/7700 Series Switches Software Patch Signature Verification Vulnerability",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@cisco.com",
          "DATE_PUBLIC": "2019-05-15T16:00:00-0700",
          "ID": "CVE-2019-1808",
          "STATE": "PUBLIC",
          "TITLE": "Cisco MDS 9700 Series Multilayer Directors and Nexus 7000/7700 Series Switches Software Patch Signature Verification Vulnerability"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Cisco NX-OS Software",
                      "version": {
                        "version_data": [
                          {
                            "affected": "\u003c",
                            "version_affected": "\u003c",
                            "version_value": "8.3(1)"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Cisco"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level credentials to install a malicious software patch on an affected device. The vulnerability is due to improper verification of digital signatures for patch images. An attacker could exploit this vulnerability by loading an unsigned software patch on an affected device. A successful exploit could allow the attacker to boot a malicious software patch image."
            }
          ]
        },
        "exploit": [
          {
            "lang": "en",
            "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
          }
        ],
        "impact": {
          "cvss": {
            "baseScore": "6.7",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-347"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20190515 Cisco MDS 9700 Series Multilayer Directors and Nexus 7000/7700 Series Switches Software Patch Signature Verification Vulnerability",
              "refsource": "CISCO",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-spsv"
            },
            {
              "name": "108367",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/108367"
            }
          ]
        },
        "source": {
          "advisory": "cisco-sa-20190515-nxos-spsv",
          "defect": [
            [
              "CSCvi42248"
            ]
          ],
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2019-1808",
    "datePublished": "2019-05-15T22:15:30.009Z",
    "dateReserved": "2018-12-06T00:00:00.000Z",
    "dateUpdated": "2024-11-20T17:19:27.801Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

BDU:2019-01982

CVE-2019-1808 (GCVE-0-2019-1808)

Tags

Sightings

Nomenclature