National Vulnerability Database

National Vulnerability Database

National Vulnerability
Database

CVE-2019-1600 Detail

Current Description

A vulnerability in the file system permissions of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to access sensitive information that is stored in the file system of an affected system. The vulnerability is due to improper implementation of file system permissions. An attacker could exploit this vulnerability by accessing and modifying restricted files. A successful exploit could allow the attacker to access sensitive and critical files. Firepower 4100 Series Next-Generation Firewalls are affected in versions prior to 2.2.2.91 and 2.3.1.110. Firepower 9300 Series Next-Generation Firewalls are affected in versions prior to 2.2.2.91 and 2.3.1.110. MDS 9000 Series Multilayer Switches are affected in versions prior to 6.2(25), 8.1(1b), and 8.3(1). Nexus 3000 Series Switches are affected in versions prior to 7.0(3)I4(9) and 7.0(3)I7(4). Nexus 3500 Platform Switches are affected in versions prior to 6.0(2)A8(10) and 7.0(3)I7(4). Nexus 3600 Platform Switches are affected in versions prior to 7.0(3)F3(5). Nexus 2000, 5500, 5600, and 6000 Series Switches are affected in versions prior to 7.1(5)N1(1b) and 7.3(3)N1(1). Nexus 7000 and 7700 Series Switches are affected in versions prior to 6.2(22), 7.3(3)D1(1), and 8.2(3). Nexus 9000 Series Switches-Standalone are affected in versions prior to 7.0(3)I4(9) and 7.0(3)I7(4). Nexus 9500 R-Series Line Cards and Fabric Modules are affected in versions prior to 7.0(3)F3(5).

Source:  MITRE
Description Last Modified:  03/07/2019
View Analysis Description

Impact

CVSS v3.0 Severity and Metrics:

Base Score: 4.4 MEDIUM
Vector: AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N (V3 legend)
Impact Score: 3.6
Exploitability Score: 0.8


Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): High
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): High
Integrity (I): None
Availability (A): None

CVSS v2.0 Severity and Metrics:

Base Score: 2.1 LOW
Vector: (AV:L/AC:L/Au:N/C:P/I:N/A:N) (V2 legend)
Impact Subscore: 2.9
Exploitability Subscore: 3.9


Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (AU): None
Confidentiality (C): Partial
Integrity (I): None
Availability (A): None
Additional Information:
Allows unauthorized disclosure of information

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink Resource
http://www.securityfocus.com/bid/107399 Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/107404 Third Party Advisory VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-nxos-directory Patch Vendor Advisory

Technical Details

Vulnerability Type (View All)

  • Information Leak / Disclosure (CWE-200)

Vulnerable software and versions Switch to CPE 2.2

Configuration 1
AND
OR
cpe:2.3:o:cisco:fxos:*:*:*:*:*:*:*:*    versions from (including) 1.1 up to (excluding) 2.2.2.91
cpe:2.3:o:cisco:fxos:*:*:*:*:*:*:*:*    versions from (including) 2.3 up to (excluding) 2.3.1.110
OR
cpe:2.3:h:cisco:firepower_4100:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:firepower_9300:-:*:*:*:*:*:*:*
Configuration 2
AND
OR
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*    versions from (including) 8.2 up to (excluding) 8.3\(1\)
OR
cpe:2.3:h:cisco:mds_9000:-:*:*:*:*:*:*:*
Configuration 3
AND
OR
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*    versions from (including) 7.0\(3\)i5 up to (excluding) 7.0\(3\)i7\(4\)
OR
cpe:2.3:h:cisco:nexus_3000:-:*:*:*:*:*:*:*
Configuration 4
AND
OR
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*    versions from (including) 7.0\(3\) up to (excluding) 7.0\(3\)i7\(4\)
OR
cpe:2.3:h:cisco:nexus_3500:-:*:*:*:*:*:*:*
Configuration 5
AND
OR
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*    versions from (including) 7.0\(3\)f3 up to (excluding) 7.0\(3\)f3\(5\)
OR
cpe:2.3:h:cisco:nexus_3600:-:*:*:*:*:*:*:*
Configuration 6
AND
OR
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*    versions from (including) 7.2 up to (excluding) 7.3\(3\)n1\(1\)
OR
cpe:2.3:h:cisco:nexus_2000:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_5500:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_5600:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_6000:-:*:*:*:*:*:*:*
Configuration 7
AND
OR
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*    versions from (including) 8.0 up to (excluding) 8.2\(3\)
OR
cpe:2.3:h:cisco:nexus_7000:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_7700:-:*:*:*:*:*:*:*
Configuration 8
AND
OR
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*    versions from (including) 7.0\(3\)i5 up to (excluding) 7.0\(3\)i7\(4\)
OR
cpe:2.3:h:cisco:nexus_9000:-:*:*:*:*:*:*:*
Configuration 9
AND
OR
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*    versions from (including) 7.0\(3\)f1 up to (excluding) 7.0\(3\)f3\(5\)
OR
cpe:2.3:h:cisco:nexus_9500:-:*:*:*:*:*:*:*
Configuration 10
AND
OR
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*    versions from (including) 7.3 up to (excluding) 8.1\(1b\)
OR
cpe:2.3:h:cisco:mds_9000:-:*:*:*:*:*:*:*
Configuration 11
AND
OR
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*    versions from (including) 5.2. up to (excluding) 6.2\(25\)
OR
cpe:2.3:h:cisco:mds_9000:-:*:*:*:*:*:*:*
Configuration 12
AND
OR
cpe:2.3:o:cisco:fxos:*:*:*:*:*:*:*:*    versions up to (excluding) 2.2.2.91
OR
cpe:2.3:h:cisco:firepower_4100:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:firepower_9300:-:*:*:*:*:*:*:*
Configuration 13
AND
OR
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*    versions up to (excluding) 7.0\(3\)i4\(9\)
OR
cpe:2.3:h:cisco:nexus_3000:-:*:*:*:*:*:*:*
Configuration 14
AND
OR
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*    versions up to (excluding) 6.0\(2\)a8\(10\)
OR
cpe:2.3:h:cisco:nexus_3500:-:*:*:*:*:*:*:*
Configuration 15
AND
OR
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*    versions up to (excluding) 7.1\(5\)n1\(1b\)
OR
cpe:2.3:h:cisco:nexus_2000:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_5500:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_5600:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_6000:-:*:*:*:*:*:*:*
Configuration 16
AND
OR
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*    versions from (including) 7.2 up to (excluding) 7.3\(3\)d1\(1\)
OR
cpe:2.3:h:cisco:nexus_7000:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_7700:-:*:*:*:*:*:*:*
Configuration 17
AND
OR
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*    versions up to (excluding) 6.2\(22\)
OR
cpe:2.3:h:cisco:nexus_7000:-:*:*:*:*:*:*:*
cpe:2.3:h:cisco:nexus_7700:-:*:*:*:*:*:*:*
Configuration 18
AND
OR
cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*    versions up to (excluding) 7.0\(3\)i4\(9\)
OR
cpe:2.3:h:cisco:nexus_9000:-:*:*:*:*:*:*:*

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

3 change records found - show changes

Quick Info

CVE Dictionary Entry:
CVE-2019-1600
NVD Published Date:
03/07/2019
NVD Last Modified:
03/18/2019