Details of VAR-201911-1327

ID

VAR-201911-1327

CVE

CVE-2019-1734

TITLE

Cisco FXOS and NX-OS Information disclosure vulnerability in software

Trust: 0.8

sources: JVNDB: JVNDB-2019-011854

DESCRIPTION

A vulnerability in the implementation of a CLI diagnostic command in Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to view sensitive system files that should be restricted. The attacker could use this information to conduct additional reconnaissance attacks. The vulnerability is due to incomplete role-based access control (RBAC) verification. An attacker could exploit this vulnerability by authenticating to the device and issuing a specific CLI diagnostic command with crafted user-input parameters. An exploit could allow the attacker to perform an arbitrary read of a file on the device, and the file may contain sensitive information. The attacker needs valid device credentials to exploit this vulnerability. Cisco FXOS and NX-OS The software contains an information disclosure vulnerability.Information may be obtained. This issue is being tracked by Cisco Bug IDs CSCvj59436, CSCvk50808, CSCvk50810, CSCvk50814, CSCvk50816 and CSCvk50838

Trust: 1.89

sources: NVD: CVE-2019-1734 // JVNDB: JVNDB-2019-011854 // BID: 108381

AFFECTED PRODUCTS

vendor:	cisco	model:	nx-os	scope:	lt	version:	6.2\(7\)	Trust: 1.0
vendor:	cisco	model:	nx-os	scope:	lt	version:	6.0\(2\)a4\(1\)	Trust: 1.0
vendor:	cisco	model:	nx-os	scope:	lt	version:	7.0\(3\)i7\(6\)	Trust: 1.0
vendor:	cisco	model:	nx-os	scope:	lt	version:	6.2\(6\)	Trust: 1.0
vendor:	cisco	model:	firepower extensible operating system	scope:	gte	version:	2.4	Trust: 1.0
vendor:	cisco	model:	nx-os	scope:	gte	version:	7.0\(3\)i4	Trust: 1.0
vendor:	cisco	model:	nx-os	scope:	lt	version:	7.0\(3\)i4\(9\)	Trust: 1.0
vendor:	cisco	model:	nx-os	scope:	gte	version:	7.0\(3\)i7	Trust: 1.0
vendor:	cisco	model:	nx-os	scope:	gte	version:	7.0\(3\)	Trust: 1.0
vendor:	cisco	model:	nx-os	scope:	lt	version:	4.0\(1a\)	Trust: 1.0
vendor:	cisco	model:	firepower extensible operating system	scope:	lt	version:	2.3.1.111	Trust: 1.0
vendor:	cisco	model:	nx-os	scope:	gte	version:	7.2	Trust: 1.0
vendor:	cisco	model:	firepower extensible operating system	scope:	lt	version:	2.2.2.91	Trust: 1.0
vendor:	cisco	model:	nx-os	scope:	lt	version:	7.0\(3\)f3\(5\)	Trust: 1.0
vendor:	cisco	model:	nx-os	scope:	lt	version:	7.3\(0\)n1\(1\)	Trust: 1.0
vendor:	cisco	model:	firepower extensible operating system	scope:	gte	version:	2.3	Trust: 1.0
vendor:	cisco	model:	firepower extensible operating system	scope:	lt	version:	2.4.1.101	Trust: 1.0
vendor:	cisco	model:	nx-os	scope:	lt	version:	7.1\(4\)n1\(1\)	Trust: 1.0
vendor:	cisco	model:	nx-os	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	fx-os	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	ucs series fabric interconnects	scope:	eq	version:	63000	Trust: 0.3
vendor:	cisco	model:	ucs series fabric interconnects	scope:	eq	version:	62000	Trust: 0.3
vendor:	cisco	model:	nx-os	scope:	eq	version:	7.3	Trust: 0.3
vendor:	cisco	model:	nx-os	scope:	eq	version:	7.2	Trust: 0.3
vendor:	cisco	model:	nx-os	scope:	eq	version:	7.1	Trust: 0.3
vendor:	cisco	model:	nx-os 7.0 i7	scope:	-	version:	-	Trust: 0.3
vendor:	cisco	model:	nx-os 7.0 i4	scope:	-	version:	-	Trust: 0.3
vendor:	cisco	model:	nx-os	scope:	eq	version:	7.0(3)	Trust: 0.3
vendor:	cisco	model:	nx-os	scope:	eq	version:	6.2	Trust: 0.3
vendor:	cisco	model:	nx-os 6.0 a	scope:	-	version:	-	Trust: 0.3
vendor:	cisco	model:	nx-os	scope:	eq	version:	4.0	Trust: 0.3
vendor:	cisco	model:	nexus r-series switching platform	scope:	eq	version:	95000	Trust: 0.3
vendor:	cisco	model:	nexus series switches standalone nx-os mode	scope:	eq	version:	9000-0	Trust: 0.3
vendor:	cisco	model:	nexus series switches	scope:	eq	version:	77000	Trust: 0.3
vendor:	cisco	model:	nexus series switches	scope:	eq	version:	70000	Trust: 0.3
vendor:	cisco	model:	nexus series switches	scope:	eq	version:	60000	Trust: 0.3
vendor:	cisco	model:	nexus platform switches	scope:	eq	version:	56000	Trust: 0.3
vendor:	cisco	model:	nexus platform switches	scope:	eq	version:	55000	Trust: 0.3
vendor:	cisco	model:	nexus platform switches	scope:	eq	version:	36000	Trust: 0.3
vendor:	cisco	model:	nexus platform switches	scope:	eq	version:	35000	Trust: 0.3
vendor:	cisco	model:	nexus series switches	scope:	eq	version:	30000	Trust: 0.3
vendor:	cisco	model:	mds series multilayer switches	scope:	eq	version:	90000	Trust: 0.3
vendor:	cisco	model:	fxos	scope:	eq	version:	2.4	Trust: 0.3
vendor:	cisco	model:	fxos	scope:	eq	version:	2.3	Trust: 0.3
vendor:	cisco	model:	fxos	scope:	eq	version:	2.2	Trust: 0.3
vendor:	cisco	model:	firepower security appliances	scope:	eq	version:	93000	Trust: 0.3
vendor:	cisco	model:	firepower series	scope:	eq	version:	41000	Trust: 0.3
vendor:	cisco	model:	nx-os 7.3 n1	scope:	ne	version:	-	Trust: 0.3
vendor:	cisco	model:	nx-os 7.1 n1	scope:	ne	version:	-	Trust: 0.3
vendor:	cisco	model:	nx-os 7.0 i7	scope:	ne	version:	-	Trust: 0.3
vendor:	cisco	model:	nx-os 7.0 i4	scope:	ne	version:	-	Trust: 0.3
vendor:	cisco	model:	nx-os 7.0 f3	scope:	ne	version:	-	Trust: 0.3
vendor:	cisco	model:	nx-os	scope:	ne	version:	6.2(7)	Trust: 0.3
vendor:	cisco	model:	nx-os	scope:	ne	version:	6.2(6)	Trust: 0.3
vendor:	cisco	model:	nx-os 6.0 a4	scope:	ne	version:	-	Trust: 0.3
vendor:	cisco	model:	nx-os 4.0	scope:	ne	version:	-	Trust: 0.3
vendor:	cisco	model:	fxos	scope:	ne	version:	2.4.1.101	Trust: 0.3
vendor:	cisco	model:	fxos	scope:	ne	version:	2.3.1.111	Trust: 0.3
vendor:	cisco	model:	fxos	scope:	ne	version:	2.2.2.91	Trust: 0.3

sources: BID: 108381 // JVNDB: JVNDB-2019-011854 // NVD: CVE-2019-1734

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-1734
value:	MEDIUM
Trust: 1.0
ykramarz@cisco.com:	CVE-2019-1734
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2019-1734
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201905-723
value:	MEDIUM
Trust: 0.6

nvd@nist.gov:	CVE-2019-1734
severity:	LOW
baseScore:	2.1
vectorString:	AV:L/AC:L/AU:N/C:P/I:N/A:N
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8

ykramarz@cisco.com:	CVE-2019-1734
baseSeverity:	MEDIUM
baseScore:	5.5
vectorString:	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	1.8
impactScore:	3.6
version:	3.0
Trust: 1.8
nvd@nist.gov:	CVE-2019-1734
baseSeverity:	MEDIUM
baseScore:	5.5
vectorString:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	1.8
impactScore:	3.6
version:	3.1
Trust: 1.0

sources: JVNDB: JVNDB-2019-011854 // CNNVD: CNNVD-201905-723 // NVD: CVE-2019-1734 // NVD: CVE-2019-1734

PROBLEMTYPE DATA

problemtype:	CWE-200	Trust: 1.8
problemtype:	NVD-CWE-Other	Trust: 1.0

sources: JVNDB: JVNDB-2019-011854 // NVD: CVE-2019-1734

THREAT TYPE

local

Trust: 0.9

sources: BID: 108381 // CNNVD: CNNVD-201905-723

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-201905-723

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-011854

PATCH

title:	cisco-sa-20190515-nxos-fxos-info	url:	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-fxos-info	Trust: 0.8
title:	Cisco FXOS Software and Cisco NX-OS Software Repair measures for information disclosure vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=92856	Trust: 0.6

sources: JVNDB: JVNDB-2019-011854 // CNNVD: CNNVD-201905-723

EXTERNAL IDS

db:	NVD	id:	CVE-2019-1734	Trust: 2.7
db:	BID	id:	108381	Trust: 0.9
db:	JVNDB	id:	JVNDB-2019-011854	Trust: 0.8
db:	AUSCERT	id:	ESB-2019.1759.4	Trust: 0.6
db:	AUSCERT	id:	ESB-2019.1759.3	Trust: 0.6
db:	AUSCERT	id:	ESB-2019.1759.5	Trust: 0.6
db:	CNNVD	id:	CNNVD-201905-723	Trust: 0.6

sources: BID: 108381 // JVNDB: JVNDB-2019-011854 // CNNVD: CNNVD-201905-723 // NVD: CVE-2019-1734

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190515-nxos-fxos-info	Trust: 2.5
url:	https://nvd.nist.gov/vuln/detail/cve-2019-1734	Trust: 1.4
url:	https://www.securityfocus.com/bid/108381	Trust: 1.2
url:	http://www.cisco.com/	Trust: 0.9
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-1734	Trust: 0.8
url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190515-fxos-nxos-cmdinj-1781-1782	Trust: 0.6
url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190515-nxos-snmp-dos	Trust: 0.6
url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190515-nxos-conf-bypass	Trust: 0.6
url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190515-nxos-cmdinj-1795	Trust: 0.6
url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190515-nxos-fxos-cmdinj-1780	Trust: 0.6
url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190515-nxos-fxos-cmdinj-1779	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2019.1759.5/	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2019.1759.4/	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2019.1759.3/	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/81118	Trust: 0.6

sources: BID: 108381 // JVNDB: JVNDB-2019-011854 // CNNVD: CNNVD-201905-723 // NVD: CVE-2019-1734

CREDITS

Cisco.

Trust: 0.9

sources: BID: 108381 // CNNVD: CNNVD-201905-723

SOURCES

db:	BID	id:	108381
db:	JVNDB	id:	JVNDB-2019-011854
db:	CNNVD	id:	CNNVD-201905-723
db:	NVD	id:	CVE-2019-1734

LAST UPDATE DATE

2024-11-23T21:52:17.642000+00:00

SOURCES UPDATE DATE

db:	BID	id:	108381	date:	2019-05-15T00:00:00
db:	JVNDB	id:	JVNDB-2019-011854	date:	2019-11-19T00:00:00
db:	CNNVD	id:	CNNVD-201905-723	date:	2020-10-21T00:00:00
db:	NVD	id:	CVE-2019-1734	date:	2024-11-21T04:37:12.463

SOURCES RELEASE DATE

db:	BID	id:	108381	date:	2019-05-15T00:00:00
db:	JVNDB	id:	JVNDB-2019-011854	date:	2019-11-19T00:00:00
db:	CNNVD	id:	CNNVD-201905-723	date:	2019-05-16T00:00:00
db:	NVD	id:	CVE-2019-1734	date:	2019-11-05T20:15:11.297