PT-2019-2296 · Cisco · Cisco Nx-Os+1

Publicado 2019-05-15 · Atualizado 2020-10-09 · CVE-2019-1731

Positive Technologies (AI Summary)

CVSS v2.0

5.6

Média

Vetor base

AV:L/AC:L/Au:N/C:C/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco NX-OS Software (affected versions not specified)

Description The issue is related to errors in SSH key management in the Cisco NX-OS network operating system. It could allow an authenticated, local attacker to expose a user's private SSH key to all authenticated users on the targeted device. The attacker must have valid administrator device credentials. The vulnerability is due to incomplete error handling during SSH key export and import. A successful exploit could allow the attacker to expose a user's private SSH key or unintentionally import a passphrase-protected private SSH key.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Handling of Exceptional Conditions

RCE

Information Disclosure

Enumeração de Fraquezas

CWE-755

CWE-20

CWE-200

Identificadores relacionados

BDU:2019-02067

CVE-2019-1731

Produtos afetados

Cisco Nx-Os

Cisco Nexus

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-1731?cpeVersion=2.2 · Nota de Segurança
• https://bdu.fstec.ru/vul/2019-02067 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2019-1731 · Nota de Segurança
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-ssh-info · Aviso do Fabricante
• http://securityfocus.com/bid/108353 · Nota
• https://osv.dev/vulnerability/CVE-2019-1731 · Aviso do Fabricante