PT-2019-1564 · Cisco · Tetration Analytics+2

Publicado 2019-03-06 · Atualizado 2020-10-05 · CVE-2019-1618

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Nexus 9000 Series Switches in standalone NX-OS mode versions prior to 7.0(3)I7(5)

Description A vulnerability in the Tetration Analytics agent could allow an authenticated, local attacker to execute arbitrary code as root due to an incorrect permissions setting. An attacker could exploit this vulnerability by replacing valid agent files with malicious code, resulting in the execution of code supplied by the attacker.

Recommendations For versions prior to 7.0(3)I7(5), update to version 7.0(3)I7(5) or later to resolve the issue. As a temporary workaround, consider restricting access to the Tetration Analytics agent to minimize the risk of exploitation.

Correção

Incorrect Permission

Enumeração de Fraquezas

CWE-732

CWE-275

Identificadores relacionados

BDU:2019-01095

CVE-2019-1618

Produtos afetados

Cisco Nexus

Cisco Nexus 9000 Series Switches

Tetration Analytics

Referências · 5

• https://osv.dev/vulnerability/CVE-2019-1618 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-1618 · Nota de Segurança
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-tetra-ace · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-01095 · Nota de Segurança
• http://securityfocus.com/bid/107322 · Nota