Privilege escalation in Cisco Nexus

1) Privilege escalation

EUVDB-ID: #VU8895

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-12301

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local attacker to gain elevated privileges.

The weakness exists in the Python scripting subsystem of Cisco NX-OS Software due to insufficient sanitization of user-supplied parameters that are passed to certain Python functions within the scripting sandbox. A local attacker can escape the scripting sandbox and execute arbitrary commands on the underlying operating system with elevated privileges.

Successful exploitation of the vulnerability may result in system compromise.

Mitigation

Update Cisco Nexus 7000 to version 7.3(2)D1(1), 8.1(1) or 8.2(1).
Update Cisco Nexus 9000 to version 7.0(3)I7(1).
Update Cisco Nexus 3000 to version 6.0(2)A8(7).

Vulnerable software versions

Cisco Nexus 5000 Series Switches: 7.0.0 HSK.0.357 - 8.1.0.2 S0

Cisco Nexus 3000 Series Switches: 6.0.2 A8.3 - 8.1.0 BD.0.20

Cisco Nexus 9000 Series Switches: 7.0.3 I4.6 - 8.1.0 BD.0.20

Cisco Nexus 7000 Series Switches: 7.3.2 D1.0.21 - 8.1.0.70 S0

Cisco Nexus 9500 R-Series: All versions

Cisco Nexus 7700 Series Switches: All versions

Cisco Nexus 6000 Series Switches: All versions

Cisco Nexus 5600 Series Switches: All versions

Cisco Nexus 5500 Series Switches: All versions

Nexus 3500 Series Switches: All versions

Cisco Nexus 2000 Series Switches: All versions

External links

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-ppe

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.