{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T18:28:42.300Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "20190515 Cisco NX-OS Software Remote Package Manager Command Injection Vulnerability",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_CISCO",
                     "x_transferred",
                  ],
                  url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-rpm-injec",
               },
               {
                  name: "108361",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/108361",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2019-1732",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-20T16:55:02.340631Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-20T17:22:27.579Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "Cisco NX-OS Software",
               vendor: "Cisco",
               versions: [
                  {
                     lessThan: "8.3(1)",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         datePublic: "2019-05-15T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "A vulnerability in the Remote Package Manager (RPM) subsystem of Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to leverage a time-of-check, time-of-use (TOCTOU) race condition to corrupt local variables, which could lead to arbitrary command injection. The vulnerability is due to the lack of a proper locking mechanism on critical variables that need to stay static until used. An attacker could exploit this vulnerability by authenticating to an affected device and issuing a set of RPM-related CLI commands. A successful exploit could allow the attacker to perform arbitrary command injection. The attacker would need administrator credentials for the targeted device.",
            },
         ],
         exploits: [
            {
               lang: "en",
               value: "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "HIGH",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 6.4,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "HIGH",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-78",
                     description: "CWE-78",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2019-05-17T09:06:06",
            orgId: "d1c1063e-7a18-46af-9102-31f8928bc633",
            shortName: "cisco",
         },
         references: [
            {
               name: "20190515 Cisco NX-OS Software Remote Package Manager Command Injection Vulnerability",
               tags: [
                  "vendor-advisory",
                  "x_refsource_CISCO",
               ],
               url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-rpm-injec",
            },
            {
               name: "108361",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/108361",
            },
         ],
         source: {
            advisory: "cisco-sa-20190515-nxos-rpm-injec",
            defect: [
               [
                  "CSCvi01453",
                  "CSCvj00550",
               ],
            ],
            discovery: "INTERNAL",
         },
         title: "Cisco NX-OS Software Remote Package Manager Command Injection Vulnerability",
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "psirt@cisco.com",
               DATE_PUBLIC: "2019-05-15T16:00:00-0700",
               ID: "CVE-2019-1732",
               STATE: "PUBLIC",
               TITLE: "Cisco NX-OS Software Remote Package Manager Command Injection Vulnerability",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "Cisco NX-OS Software",
                                 version: {
                                    version_data: [
                                       {
                                          affected: "<",
                                          version_affected: "<",
                                          version_value: "8.3(1)",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Cisco",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A vulnerability in the Remote Package Manager (RPM) subsystem of Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to leverage a time-of-check, time-of-use (TOCTOU) race condition to corrupt local variables, which could lead to arbitrary command injection. The vulnerability is due to the lack of a proper locking mechanism on critical variables that need to stay static until used. An attacker could exploit this vulnerability by authenticating to an affected device and issuing a set of RPM-related CLI commands. A successful exploit could allow the attacker to perform arbitrary command injection. The attacker would need administrator credentials for the targeted device.",
                  },
               ],
            },
            exploit: [
               {
                  lang: "en",
                  value: "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.",
               },
            ],
            impact: {
               cvss: {
                  baseScore: "6.4",
                  vectorString: "CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-78",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "20190515 Cisco NX-OS Software Remote Package Manager Command Injection Vulnerability",
                     refsource: "CISCO",
                     url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-rpm-injec",
                  },
                  {
                     name: "108361",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/108361",
                  },
               ],
            },
            source: {
               advisory: "cisco-sa-20190515-nxos-rpm-injec",
               defect: [
                  [
                     "CSCvi01453",
                     "CSCvj00550",
                  ],
               ],
               discovery: "INTERNAL",
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "d1c1063e-7a18-46af-9102-31f8928bc633",
      assignerShortName: "cisco",
      cveId: "CVE-2019-1732",
      datePublished: "2019-05-15T16:50:29.893438Z",
      dateReserved: "2018-12-06T00:00:00",
      dateUpdated: "2024-11-20T17:22:27.579Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-07T08:01:40.150Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "http://sourceforge.net/tracker/index.php?func=detail&aid=1989089&group_id=12694&atid=456380",
               },
               {
                  name: "35463",
                  tags: [
                     "third-party-advisory",
                     "x_refsource_SECUNIA",
                     "x_transferred",
                  ],
                  url: "http://secunia.com/advisories/35463",
               },
               {
                  name: "30615",
                  tags: [
                     "third-party-advisory",
                     "x_refsource_SECUNIA",
                     "x_transferred",
                  ],
                  url: "http://secunia.com/advisories/30615",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "http://support.apple.com/kb/HT2163",
               },
               {
                  name: "ADV-2008-1787",
                  tags: [
                     "vdb-entry",
                     "x_refsource_VUPEN",
                     "x_transferred",
                  ],
                  url: "http://www.vupen.com/english/advisories/2008/1787/references",
               },
               {
                  name: "30648",
                  tags: [
                     "third-party-advisory",
                     "x_refsource_SECUNIA",
                     "x_transferred",
                  ],
                  url: "http://secunia.com/advisories/30648",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "http://www.kb.cert.org/vuls/id/CTAR-7FBS8Q",
               },
               {
                  name: "32664",
                  tags: [
                     "third-party-advisory",
                     "x_refsource_SECUNIA",
                     "x_transferred",
                  ],
                  url: "http://secunia.com/advisories/32664",
               },
               {
                  name: "ADV-2008-1981",
                  tags: [
                     "vdb-entry",
                     "x_refsource_VUPEN",
                     "x_transferred",
                  ],
                  url: "http://www.vupen.com/english/advisories/2008/1981/references",
               },
               {
                  name: "ADV-2008-1801",
                  tags: [
                     "vdb-entry",
                     "x_refsource_VUPEN",
                     "x_transferred",
                  ],
                  url: "http://www.vupen.com/english/advisories/2008/1801/references",
               },
               {
                  name: "SUSE-SA:2008:039",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00000.html",
               },
               {
                  name: "[productinfo] 20080611 Ingate Firewall and SIParator affected by SNMPv3 vulnerability",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://lists.ingate.com/pipermail/productinfo/2008/000021.html",
               },
               {
                  name: "31351",
                  tags: [
                     "third-party-advisory",
                     "x_refsource_SECUNIA",
                     "x_transferred",
                  ],
                  url: "http://secunia.com/advisories/31351",
               },
               {
                  name: "ADV-2008-1788",
                  tags: [
                     "vdb-entry",
                     "x_refsource_VUPEN",
                     "x_transferred",
                  ],
                  url: "http://www.vupen.com/english/advisories/2008/1788/references",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "http://support.avaya.com/elmodocs2/security/ASA-2008-282.htm",
               },
               {
                  name: "FEDORA-2008-5215",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00363.html",
               },
               {
                  name: "29623",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/29623",
               },
               {
                  name: "31334",
                  tags: [
                     "third-party-advisory",
                     "x_refsource_SECUNIA",
                     "x_transferred",
                  ],
                  url: "http://secunia.com/advisories/31334",
               },
               {
                  name: "ADV-2008-2971",
                  tags: [
                     "vdb-entry",
                     "x_refsource_VUPEN",
                     "x_transferred",
                  ],
                  url: "http://www.vupen.com/english/advisories/2008/2971",
               },
               {
                  name: "oval:org.mitre.oval:def:10820",
                  tags: [
                     "vdb-entry",
                     "signature",
                     "x_refsource_OVAL",
                     "x_transferred",
                  ],
                  url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10820",
               },
               {
                  name: "oval:org.mitre.oval:def:6414",
                  tags: [
                     "vdb-entry",
                     "signature",
                     "x_refsource_OVAL",
                     "x_transferred",
                  ],
                  url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6414",
               },
               {
                  name: "30626",
                  tags: [
                     "third-party-advisory",
                     "x_refsource_SECUNIA",
                     "x_transferred",
                  ],
                  url: "http://secunia.com/advisories/30626",
               },
               {
                  name: "SSRT080082",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_HP",
                     "x_transferred",
                  ],
                  url: "http://marc.info/?l=bugtraq&m=127730470825399&w=2",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "http://www.vmware.com/security/advisories/VMSA-2008-0017.html",
               },
               {
                  name: "[oss-security] 20080609 [oCERT-2008-006] multiple SNMP implementations HMAC authentication spoofing",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2008/06/09/1",
               },
               {
                  name: "HPSBMA02439",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_HP",
                     "x_transferred",
                  ],
                  url: "http://marc.info/?l=bugtraq&m=127730470825399&w=2",
               },
               {
                  name: "VU#878044",
                  tags: [
                     "third-party-advisory",
                     "x_refsource_CERT-VN",
                     "x_transferred",
                  ],
                  url: "http://www.kb.cert.org/vuls/id/878044",
               },
               {
                  name: "30647",
                  tags: [
                     "third-party-advisory",
                     "x_refsource_SECUNIA",
                     "x_transferred",
                  ],
                  url: "http://secunia.com/advisories/30647",
               },
               {
                  name: "238865",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUNALERT",
                     "x_transferred",
                  ],
                  url: "http://sunsolve.sun.com/search/document.do?assetkey=1-26-238865-1",
               },
               {
                  name: "20081031 VMSA-2008-0017 Updated ESX packages for libxml2, ucd-snmp, libtiff",
                  tags: [
                     "mailing-list",
                     "x_refsource_BUGTRAQ",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/archive/1/497962/100/0/threaded",
               },
               {
                  name: "ADV-2008-1836",
                  tags: [
                     "vdb-entry",
                     "x_refsource_VUPEN",
                     "x_transferred",
                  ],
                  url: "http://www.vupen.com/english/advisories/2008/1836/references",
               },
               {
                  name: "33003",
                  tags: [
                     "third-party-advisory",
                     "x_refsource_SECUNIA",
                     "x_transferred",
                  ],
                  url: "http://secunia.com/advisories/33003",
               },
               {
                  name: "20080610 SNMP Version 3 Authentication Vulnerabilities",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_CISCO",
                     "x_transferred",
                  ],
                  url: "http://www.cisco.com/warp/public/707/cisco-sa-20080610-snmpv3.shtml",
               },
               {
                  name: "ADV-2008-2361",
                  tags: [
                     "vdb-entry",
                     "x_refsource_VUPEN",
                     "x_transferred",
                  ],
                  url: "http://www.vupen.com/english/advisories/2008/2361",
               },
               {
                  name: "31568",
                  tags: [
                     "third-party-advisory",
                     "x_refsource_SECUNIA",
                     "x_transferred",
                  ],
                  url: "http://secunia.com/advisories/31568",
               },
               {
                  name: "31467",
                  tags: [
                     "third-party-advisory",
                     "x_refsource_SECUNIA",
                     "x_transferred",
                  ],
                  url: "http://secunia.com/advisories/31467",
               },
               {
                  name: "APPLE-SA-2008-06-30",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_APPLE",
                     "x_transferred",
                  ],
                  url: "http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html",
               },
               {
                  name: "DSA-1663",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "http://www.debian.org/security/2008/dsa-1663",
               },
               {
                  name: "TA08-162A",
                  tags: [
                     "third-party-advisory",
                     "x_refsource_CERT",
                     "x_transferred",
                  ],
                  url: "http://www.us-cert.gov/cas/techalerts/TA08-162A.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "http://www.kb.cert.org/vuls/id/MIMG-7ETS87",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "http://www.ocert.org/advisories/ocert-2008-006.html",
               },
               {
                  name: "RHSA-2008:0528",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2008-0528.html",
               },
               {
                  name: "3933",
                  tags: [
                     "third-party-advisory",
                     "x_refsource_SREASON",
                     "x_transferred",
                  ],
                  url: "http://securityreason.com/securityalert/3933",
               },
               {
                  name: "RHSA-2008:0529",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "http://www.redhat.com/support/errata/RHSA-2008-0529.html",
               },
               {
                  name: "30612",
                  tags: [
                     "third-party-advisory",
                     "x_refsource_SECUNIA",
                     "x_transferred",
                  ],
                  url: "http://secunia.com/advisories/30612",
               },
               {
                  name: "30802",
                  tags: [
                     "third-party-advisory",
                     "x_refsource_SECUNIA",
                     "x_transferred",
                  ],
                  url: "http://secunia.com/advisories/30802",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=447974",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "http://www.vmware.com/security/advisories/VMSA-2008-0013.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "http://www.kb.cert.org/vuls/id/MIMG-7ETS5Z",
               },
               {
                  name: "5790",
                  tags: [
                     "exploit",
                     "x_refsource_EXPLOIT-DB",
                     "x_transferred",
                  ],
                  url: "https://www.exploit-db.com/exploits/5790",
               },
               {
                  name: "ADV-2008-1797",
                  tags: [
                     "vdb-entry",
                     "x_refsource_VUPEN",
                     "x_transferred",
                  ],
                  url: "http://www.vupen.com/english/advisories/2008/1797/references",
               },
               {
                  name: "GLSA-200808-02",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "http://security.gentoo.org/glsa/glsa-200808-02.xml",
               },
               {
                  name: "20080609 [oCERT-2008-006] multiple SNMP implementations HMAC authentication spoofing",
                  tags: [
                     "mailing-list",
                     "x_refsource_BUGTRAQ",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/archive/1/493218/100/0/threaded",
               },
               {
                  name: "30665",
                  tags: [
                     "third-party-advisory",
                     "x_refsource_SECUNIA",
                     "x_transferred",
                  ],
                  url: "http://secunia.com/advisories/30665",
               },
               {
                  name: "FEDORA-2008-5218",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00459.html",
               },
               {
                  name: "FEDORA-2008-5224",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00380.html",
               },
               {
                  name: "ADV-2008-1800",
                  tags: [
                     "vdb-entry",
                     "x_refsource_VUPEN",
                     "x_transferred",
                  ],
                  url: "http://www.vupen.com/english/advisories/2008/1800/references",
               },
               {
                  name: "MDVSA-2008:118",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_MANDRIVA",
                     "x_transferred",
                  ],
                  url: "http://www.mandriva.com/security/advisories?name=MDVSA-2008:118",
               },
               {
                  name: "USN-685-1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_UBUNTU",
                     "x_transferred",
                  ],
                  url: "http://www.ubuntu.com/usn/usn-685-1",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "http://sourceforge.net/forum/forum.php?forum_id=833770",
               },
               {
                  name: "1020218",
                  tags: [
                     "vdb-entry",
                     "x_refsource_SECTRACK",
                     "x_transferred",
                  ],
                  url: "http://www.securitytracker.com/id?1020218",
               },
               {
                  name: "30596",
                  tags: [
                     "third-party-advisory",
                     "x_refsource_SECUNIA",
                     "x_transferred",
                  ],
                  url: "http://secunia.com/advisories/30596",
               },
               {
                  name: "oval:org.mitre.oval:def:5785",
                  tags: [
                     "vdb-entry",
                     "signature",
                     "x_refsource_OVAL",
                     "x_transferred",
                  ],
                  url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5785",
               },
               {
                  name: "ADV-2009-1612",
                  tags: [
                     "vdb-entry",
                     "x_refsource_VUPEN",
                     "x_transferred",
                  ],
                  url: "http://www.vupen.com/english/advisories/2009/1612",
               },
               {
                  name: "30574",
                  tags: [
                     "third-party-advisory",
                     "x_refsource_SECUNIA",
                     "x_transferred",
                  ],
                  url: "http://secunia.com/advisories/30574",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2008-06-09T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "SNMPv3 HMAC verification in (1) Net-SNMP 5.2.x before 5.2.4.1, 5.3.x before 5.3.2.1, and 5.4.x before 5.4.1.1; (2) UCD-SNMP; (3) eCos; (4) Juniper Session and Resource Control (SRC) C-series 1.0.0 through 2.0.0; (5) NetApp (aka Network Appliance) Data ONTAP 7.3RC1 and 7.3RC2; (6) SNMP Research before 16.2; (7) multiple Cisco IOS, CatOS, ACE, and Nexus products; (8) Ingate Firewall 3.1.0 and later and SIParator 3.1.0 and later; (9) HP OpenView SNMP Emanate Master Agent 15.x; and possibly other products relies on the client to specify the HMAC length, which makes it easier for remote attackers to bypass SNMP authentication via a length value of 1, which only checks the first byte.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2018-10-15T20:57:01",
            orgId: "37e5125f-f79b-445b-8fad-9564f167944b",
            shortName: "certcc",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "http://sourceforge.net/tracker/index.php?func=detail&aid=1989089&group_id=12694&atid=456380",
            },
            {
               name: "35463",
               tags: [
                  "third-party-advisory",
                  "x_refsource_SECUNIA",
               ],
               url: "http://secunia.com/advisories/35463",
            },
            {
               name: "30615",
               tags: [
                  "third-party-advisory",
                  "x_refsource_SECUNIA",
               ],
               url: "http://secunia.com/advisories/30615",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "http://support.apple.com/kb/HT2163",
            },
            {
               name: "ADV-2008-1787",
               tags: [
                  "vdb-entry",
                  "x_refsource_VUPEN",
               ],
               url: "http://www.vupen.com/english/advisories/2008/1787/references",
            },
            {
               name: "30648",
               tags: [
                  "third-party-advisory",
                  "x_refsource_SECUNIA",
               ],
               url: "http://secunia.com/advisories/30648",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "http://www.kb.cert.org/vuls/id/CTAR-7FBS8Q",
            },
            {
               name: "32664",
               tags: [
                  "third-party-advisory",
                  "x_refsource_SECUNIA",
               ],
               url: "http://secunia.com/advisories/32664",
            },
            {
               name: "ADV-2008-1981",
               tags: [
                  "vdb-entry",
                  "x_refsource_VUPEN",
               ],
               url: "http://www.vupen.com/english/advisories/2008/1981/references",
            },
            {
               name: "ADV-2008-1801",
               tags: [
                  "vdb-entry",
                  "x_refsource_VUPEN",
               ],
               url: "http://www.vupen.com/english/advisories/2008/1801/references",
            },
            {
               name: "SUSE-SA:2008:039",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00000.html",
            },
            {
               name: "[productinfo] 20080611 Ingate Firewall and SIParator affected by SNMPv3 vulnerability",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://lists.ingate.com/pipermail/productinfo/2008/000021.html",
            },
            {
               name: "31351",
               tags: [
                  "third-party-advisory",
                  "x_refsource_SECUNIA",
               ],
               url: "http://secunia.com/advisories/31351",
            },
            {
               name: "ADV-2008-1788",
               tags: [
                  "vdb-entry",
                  "x_refsource_VUPEN",
               ],
               url: "http://www.vupen.com/english/advisories/2008/1788/references",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "http://support.avaya.com/elmodocs2/security/ASA-2008-282.htm",
            },
            {
               name: "FEDORA-2008-5215",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00363.html",
            },
            {
               name: "29623",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/29623",
            },
            {
               name: "31334",
               tags: [
                  "third-party-advisory",
                  "x_refsource_SECUNIA",
               ],
               url: "http://secunia.com/advisories/31334",
            },
            {
               name: "ADV-2008-2971",
               tags: [
                  "vdb-entry",
                  "x_refsource_VUPEN",
               ],
               url: "http://www.vupen.com/english/advisories/2008/2971",
            },
            {
               name: "oval:org.mitre.oval:def:10820",
               tags: [
                  "vdb-entry",
                  "signature",
                  "x_refsource_OVAL",
               ],
               url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10820",
            },
            {
               name: "oval:org.mitre.oval:def:6414",
               tags: [
                  "vdb-entry",
                  "signature",
                  "x_refsource_OVAL",
               ],
               url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6414",
            },
            {
               name: "30626",
               tags: [
                  "third-party-advisory",
                  "x_refsource_SECUNIA",
               ],
               url: "http://secunia.com/advisories/30626",
            },
            {
               name: "SSRT080082",
               tags: [
                  "vendor-advisory",
                  "x_refsource_HP",
               ],
               url: "http://marc.info/?l=bugtraq&m=127730470825399&w=2",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "http://www.vmware.com/security/advisories/VMSA-2008-0017.html",
            },
            {
               name: "[oss-security] 20080609 [oCERT-2008-006] multiple SNMP implementations HMAC authentication spoofing",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2008/06/09/1",
            },
            {
               name: "HPSBMA02439",
               tags: [
                  "vendor-advisory",
                  "x_refsource_HP",
               ],
               url: "http://marc.info/?l=bugtraq&m=127730470825399&w=2",
            },
            {
               name: "VU#878044",
               tags: [
                  "third-party-advisory",
                  "x_refsource_CERT-VN",
               ],
               url: "http://www.kb.cert.org/vuls/id/878044",
            },
            {
               name: "30647",
               tags: [
                  "third-party-advisory",
                  "x_refsource_SECUNIA",
               ],
               url: "http://secunia.com/advisories/30647",
            },
            {
               name: "238865",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUNALERT",
               ],
               url: "http://sunsolve.sun.com/search/document.do?assetkey=1-26-238865-1",
            },
            {
               name: "20081031 VMSA-2008-0017 Updated ESX packages for libxml2, ucd-snmp, libtiff",
               tags: [
                  "mailing-list",
                  "x_refsource_BUGTRAQ",
               ],
               url: "http://www.securityfocus.com/archive/1/497962/100/0/threaded",
            },
            {
               name: "ADV-2008-1836",
               tags: [
                  "vdb-entry",
                  "x_refsource_VUPEN",
               ],
               url: "http://www.vupen.com/english/advisories/2008/1836/references",
            },
            {
               name: "33003",
               tags: [
                  "third-party-advisory",
                  "x_refsource_SECUNIA",
               ],
               url: "http://secunia.com/advisories/33003",
            },
            {
               name: "20080610 SNMP Version 3 Authentication Vulnerabilities",
               tags: [
                  "vendor-advisory",
                  "x_refsource_CISCO",
               ],
               url: "http://www.cisco.com/warp/public/707/cisco-sa-20080610-snmpv3.shtml",
            },
            {
               name: "ADV-2008-2361",
               tags: [
                  "vdb-entry",
                  "x_refsource_VUPEN",
               ],
               url: "http://www.vupen.com/english/advisories/2008/2361",
            },
            {
               name: "31568",
               tags: [
                  "third-party-advisory",
                  "x_refsource_SECUNIA",
               ],
               url: "http://secunia.com/advisories/31568",
            },
            {
               name: "31467",
               tags: [
                  "third-party-advisory",
                  "x_refsource_SECUNIA",
               ],
               url: "http://secunia.com/advisories/31467",
            },
            {
               name: "APPLE-SA-2008-06-30",
               tags: [
                  "vendor-advisory",
                  "x_refsource_APPLE",
               ],
               url: "http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html",
            },
            {
               name: "DSA-1663",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "http://www.debian.org/security/2008/dsa-1663",
            },
            {
               name: "TA08-162A",
               tags: [
                  "third-party-advisory",
                  "x_refsource_CERT",
               ],
               url: "http://www.us-cert.gov/cas/techalerts/TA08-162A.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "http://www.kb.cert.org/vuls/id/MIMG-7ETS87",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "http://www.ocert.org/advisories/ocert-2008-006.html",
            },
            {
               name: "RHSA-2008:0528",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2008-0528.html",
            },
            {
               name: "3933",
               tags: [
                  "third-party-advisory",
                  "x_refsource_SREASON",
               ],
               url: "http://securityreason.com/securityalert/3933",
            },
            {
               name: "RHSA-2008:0529",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "http://www.redhat.com/support/errata/RHSA-2008-0529.html",
            },
            {
               name: "30612",
               tags: [
                  "third-party-advisory",
                  "x_refsource_SECUNIA",
               ],
               url: "http://secunia.com/advisories/30612",
            },
            {
               name: "30802",
               tags: [
                  "third-party-advisory",
                  "x_refsource_SECUNIA",
               ],
               url: "http://secunia.com/advisories/30802",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=447974",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "http://www.vmware.com/security/advisories/VMSA-2008-0013.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "http://www.kb.cert.org/vuls/id/MIMG-7ETS5Z",
            },
            {
               name: "5790",
               tags: [
                  "exploit",
                  "x_refsource_EXPLOIT-DB",
               ],
               url: "https://www.exploit-db.com/exploits/5790",
            },
            {
               name: "ADV-2008-1797",
               tags: [
                  "vdb-entry",
                  "x_refsource_VUPEN",
               ],
               url: "http://www.vupen.com/english/advisories/2008/1797/references",
            },
            {
               name: "GLSA-200808-02",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "http://security.gentoo.org/glsa/glsa-200808-02.xml",
            },
            {
               name: "20080609 [oCERT-2008-006] multiple SNMP implementations HMAC authentication spoofing",
               tags: [
                  "mailing-list",
                  "x_refsource_BUGTRAQ",
               ],
               url: "http://www.securityfocus.com/archive/1/493218/100/0/threaded",
            },
            {
               name: "30665",
               tags: [
                  "third-party-advisory",
                  "x_refsource_SECUNIA",
               ],
               url: "http://secunia.com/advisories/30665",
            },
            {
               name: "FEDORA-2008-5218",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00459.html",
            },
            {
               name: "FEDORA-2008-5224",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00380.html",
            },
            {
               name: "ADV-2008-1800",
               tags: [
                  "vdb-entry",
                  "x_refsource_VUPEN",
               ],
               url: "http://www.vupen.com/english/advisories/2008/1800/references",
            },
            {
               name: "MDVSA-2008:118",
               tags: [
                  "vendor-advisory",
                  "x_refsource_MANDRIVA",
               ],
               url: "http://www.mandriva.com/security/advisories?name=MDVSA-2008:118",
            },
            {
               name: "USN-685-1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_UBUNTU",
               ],
               url: "http://www.ubuntu.com/usn/usn-685-1",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "http://sourceforge.net/forum/forum.php?forum_id=833770",
            },
            {
               name: "1020218",
               tags: [
                  "vdb-entry",
                  "x_refsource_SECTRACK",
               ],
               url: "http://www.securitytracker.com/id?1020218",
            },
            {
               name: "30596",
               tags: [
                  "third-party-advisory",
                  "x_refsource_SECUNIA",
               ],
               url: "http://secunia.com/advisories/30596",
            },
            {
               name: "oval:org.mitre.oval:def:5785",
               tags: [
                  "vdb-entry",
                  "signature",
                  "x_refsource_OVAL",
               ],
               url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5785",
            },
            {
               name: "ADV-2009-1612",
               tags: [
                  "vdb-entry",
                  "x_refsource_VUPEN",
               ],
               url: "http://www.vupen.com/english/advisories/2009/1612",
            },
            {
               name: "30574",
               tags: [
                  "third-party-advisory",
                  "x_refsource_SECUNIA",
               ],
               url: "http://secunia.com/advisories/30574",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cert@cert.org",
               ID: "CVE-2008-0960",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "SNMPv3 HMAC verification in (1) Net-SNMP 5.2.x before 5.2.4.1, 5.3.x before 5.3.2.1, and 5.4.x before 5.4.1.1; (2) UCD-SNMP; (3) eCos; (4) Juniper Session and Resource Control (SRC) C-series 1.0.0 through 2.0.0; (5) NetApp (aka Network Appliance) Data ONTAP 7.3RC1 and 7.3RC2; (6) SNMP Research before 16.2; (7) multiple Cisco IOS, CatOS, ACE, and Nexus products; (8) Ingate Firewall 3.1.0 and later and SIParator 3.1.0 and later; (9) HP OpenView SNMP Emanate Master Agent 15.x; and possibly other products relies on the client to specify the HMAC length, which makes it easier for remote attackers to bypass SNMP authentication via a length value of 1, which only checks the first byte.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "http://sourceforge.net/tracker/index.php?func=detail&aid=1989089&group_id=12694&atid=456380",
                     refsource: "CONFIRM",
                     url: "http://sourceforge.net/tracker/index.php?func=detail&aid=1989089&group_id=12694&atid=456380",
                  },
                  {
                     name: "35463",
                     refsource: "SECUNIA",
                     url: "http://secunia.com/advisories/35463",
                  },
                  {
                     name: "30615",
                     refsource: "SECUNIA",
                     url: "http://secunia.com/advisories/30615",
                  },
                  {
                     name: "http://support.apple.com/kb/HT2163",
                     refsource: "CONFIRM",
                     url: "http://support.apple.com/kb/HT2163",
                  },
                  {
                     name: "ADV-2008-1787",
                     refsource: "VUPEN",
                     url: "http://www.vupen.com/english/advisories/2008/1787/references",
                  },
                  {
                     name: "30648",
                     refsource: "SECUNIA",
                     url: "http://secunia.com/advisories/30648",
                  },
                  {
                     name: "http://www.kb.cert.org/vuls/id/CTAR-7FBS8Q",
                     refsource: "CONFIRM",
                     url: "http://www.kb.cert.org/vuls/id/CTAR-7FBS8Q",
                  },
                  {
                     name: "32664",
                     refsource: "SECUNIA",
                     url: "http://secunia.com/advisories/32664",
                  },
                  {
                     name: "ADV-2008-1981",
                     refsource: "VUPEN",
                     url: "http://www.vupen.com/english/advisories/2008/1981/references",
                  },
                  {
                     name: "ADV-2008-1801",
                     refsource: "VUPEN",
                     url: "http://www.vupen.com/english/advisories/2008/1801/references",
                  },
                  {
                     name: "SUSE-SA:2008:039",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00000.html",
                  },
                  {
                     name: "[productinfo] 20080611 Ingate Firewall and SIParator affected by SNMPv3 vulnerability",
                     refsource: "MLIST",
                     url: "http://lists.ingate.com/pipermail/productinfo/2008/000021.html",
                  },
                  {
                     name: "31351",
                     refsource: "SECUNIA",
                     url: "http://secunia.com/advisories/31351",
                  },
                  {
                     name: "ADV-2008-1788",
                     refsource: "VUPEN",
                     url: "http://www.vupen.com/english/advisories/2008/1788/references",
                  },
                  {
                     name: "http://support.avaya.com/elmodocs2/security/ASA-2008-282.htm",
                     refsource: "CONFIRM",
                     url: "http://support.avaya.com/elmodocs2/security/ASA-2008-282.htm",
                  },
                  {
                     name: "FEDORA-2008-5215",
                     refsource: "FEDORA",
                     url: "https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00363.html",
                  },
                  {
                     name: "29623",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/29623",
                  },
                  {
                     name: "31334",
                     refsource: "SECUNIA",
                     url: "http://secunia.com/advisories/31334",
                  },
                  {
                     name: "ADV-2008-2971",
                     refsource: "VUPEN",
                     url: "http://www.vupen.com/english/advisories/2008/2971",
                  },
                  {
                     name: "oval:org.mitre.oval:def:10820",
                     refsource: "OVAL",
                     url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10820",
                  },
                  {
                     name: "oval:org.mitre.oval:def:6414",
                     refsource: "OVAL",
                     url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6414",
                  },
                  {
                     name: "30626",
                     refsource: "SECUNIA",
                     url: "http://secunia.com/advisories/30626",
                  },
                  {
                     name: "SSRT080082",
                     refsource: "HP",
                     url: "http://marc.info/?l=bugtraq&m=127730470825399&w=2",
                  },
                  {
                     name: "http://www.vmware.com/security/advisories/VMSA-2008-0017.html",
                     refsource: "MISC",
                     url: "http://www.vmware.com/security/advisories/VMSA-2008-0017.html",
                  },
                  {
                     name: "[oss-security] 20080609 [oCERT-2008-006] multiple SNMP implementations HMAC authentication spoofing",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2008/06/09/1",
                  },
                  {
                     name: "HPSBMA02439",
                     refsource: "HP",
                     url: "http://marc.info/?l=bugtraq&m=127730470825399&w=2",
                  },
                  {
                     name: "VU#878044",
                     refsource: "CERT-VN",
                     url: "http://www.kb.cert.org/vuls/id/878044",
                  },
                  {
                     name: "30647",
                     refsource: "SECUNIA",
                     url: "http://secunia.com/advisories/30647",
                  },
                  {
                     name: "238865",
                     refsource: "SUNALERT",
                     url: "http://sunsolve.sun.com/search/document.do?assetkey=1-26-238865-1",
                  },
                  {
                     name: "20081031 VMSA-2008-0017 Updated ESX packages for libxml2, ucd-snmp, libtiff",
                     refsource: "BUGTRAQ",
                     url: "http://www.securityfocus.com/archive/1/497962/100/0/threaded",
                  },
                  {
                     name: "ADV-2008-1836",
                     refsource: "VUPEN",
                     url: "http://www.vupen.com/english/advisories/2008/1836/references",
                  },
                  {
                     name: "33003",
                     refsource: "SECUNIA",
                     url: "http://secunia.com/advisories/33003",
                  },
                  {
                     name: "20080610 SNMP Version 3 Authentication Vulnerabilities",
                     refsource: "CISCO",
                     url: "http://www.cisco.com/warp/public/707/cisco-sa-20080610-snmpv3.shtml",
                  },
                  {
                     name: "ADV-2008-2361",
                     refsource: "VUPEN",
                     url: "http://www.vupen.com/english/advisories/2008/2361",
                  },
                  {
                     name: "31568",
                     refsource: "SECUNIA",
                     url: "http://secunia.com/advisories/31568",
                  },
                  {
                     name: "31467",
                     refsource: "SECUNIA",
                     url: "http://secunia.com/advisories/31467",
                  },
                  {
                     name: "APPLE-SA-2008-06-30",
                     refsource: "APPLE",
                     url: "http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html",
                  },
                  {
                     name: "DSA-1663",
                     refsource: "DEBIAN",
                     url: "http://www.debian.org/security/2008/dsa-1663",
                  },
                  {
                     name: "TA08-162A",
                     refsource: "CERT",
                     url: "http://www.us-cert.gov/cas/techalerts/TA08-162A.html",
                  },
                  {
                     name: "http://www.kb.cert.org/vuls/id/MIMG-7ETS87",
                     refsource: "CONFIRM",
                     url: "http://www.kb.cert.org/vuls/id/MIMG-7ETS87",
                  },
                  {
                     name: "http://www.ocert.org/advisories/ocert-2008-006.html",
                     refsource: "MISC",
                     url: "http://www.ocert.org/advisories/ocert-2008-006.html",
                  },
                  {
                     name: "RHSA-2008:0528",
                     refsource: "REDHAT",
                     url: "http://rhn.redhat.com/errata/RHSA-2008-0528.html",
                  },
                  {
                     name: "3933",
                     refsource: "SREASON",
                     url: "http://securityreason.com/securityalert/3933",
                  },
                  {
                     name: "RHSA-2008:0529",
                     refsource: "REDHAT",
                     url: "http://www.redhat.com/support/errata/RHSA-2008-0529.html",
                  },
                  {
                     name: "30612",
                     refsource: "SECUNIA",
                     url: "http://secunia.com/advisories/30612",
                  },
                  {
                     name: "30802",
                     refsource: "SECUNIA",
                     url: "http://secunia.com/advisories/30802",
                  },
                  {
                     name: "https://bugzilla.redhat.com/show_bug.cgi?id=447974",
                     refsource: "CONFIRM",
                     url: "https://bugzilla.redhat.com/show_bug.cgi?id=447974",
                  },
                  {
                     name: "http://www.vmware.com/security/advisories/VMSA-2008-0013.html",
                     refsource: "CONFIRM",
                     url: "http://www.vmware.com/security/advisories/VMSA-2008-0013.html",
                  },
                  {
                     name: "http://www.kb.cert.org/vuls/id/MIMG-7ETS5Z",
                     refsource: "CONFIRM",
                     url: "http://www.kb.cert.org/vuls/id/MIMG-7ETS5Z",
                  },
                  {
                     name: "5790",
                     refsource: "EXPLOIT-DB",
                     url: "https://www.exploit-db.com/exploits/5790",
                  },
                  {
                     name: "ADV-2008-1797",
                     refsource: "VUPEN",
                     url: "http://www.vupen.com/english/advisories/2008/1797/references",
                  },
                  {
                     name: "GLSA-200808-02",
                     refsource: "GENTOO",
                     url: "http://security.gentoo.org/glsa/glsa-200808-02.xml",
                  },
                  {
                     name: "20080609 [oCERT-2008-006] multiple SNMP implementations HMAC authentication spoofing",
                     refsource: "BUGTRAQ",
                     url: "http://www.securityfocus.com/archive/1/493218/100/0/threaded",
                  },
                  {
                     name: "30665",
                     refsource: "SECUNIA",
                     url: "http://secunia.com/advisories/30665",
                  },
                  {
                     name: "FEDORA-2008-5218",
                     refsource: "FEDORA",
                     url: "https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00459.html",
                  },
                  {
                     name: "FEDORA-2008-5224",
                     refsource: "FEDORA",
                     url: "https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00380.html",
                  },
                  {
                     name: "ADV-2008-1800",
                     refsource: "VUPEN",
                     url: "http://www.vupen.com/english/advisories/2008/1800/references",
                  },
                  {
                     name: "MDVSA-2008:118",
                     refsource: "MANDRIVA",
                     url: "http://www.mandriva.com/security/advisories?name=MDVSA-2008:118",
                  },
                  {
                     name: "USN-685-1",
                     refsource: "UBUNTU",
                     url: "http://www.ubuntu.com/usn/usn-685-1",
                  },
                  {
                     name: "http://sourceforge.net/forum/forum.php?forum_id=833770",
                     refsource: "CONFIRM",
                     url: "http://sourceforge.net/forum/forum.php?forum_id=833770",
                  },
                  {
                     name: "1020218",
                     refsource: "SECTRACK",
                     url: "http://www.securitytracker.com/id?1020218",
                  },
                  {
                     name: "30596",
                     refsource: "SECUNIA",
                     url: "http://secunia.com/advisories/30596",
                  },
                  {
                     name: "oval:org.mitre.oval:def:5785",
                     refsource: "OVAL",
                     url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5785",
                  },
                  {
                     name: "ADV-2009-1612",
                     refsource: "VUPEN",
                     url: "http://www.vupen.com/english/advisories/2009/1612",
                  },
                  {
                     name: "30574",
                     refsource: "SECUNIA",
                     url: "http://secunia.com/advisories/30574",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "37e5125f-f79b-445b-8fad-9564f167944b",
      assignerShortName: "certcc",
      cveId: "CVE-2008-0960",
      datePublished: "2008-06-10T18:00:00",
      dateReserved: "2008-02-25T00:00:00",
      dateUpdated: "2024-08-07T08:01:40.150Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "01EAB41F-6AE7-47D9-80EC-C9974E331506",
                     versionEndExcluding: "7.0\\(3\\)i7\\(4\\)",
                     versionStartIncluding: "7.0\\(3\\)i4",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3000:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "10FFC5E8-CC5A-4D31-A63A-19E72EC442AB",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3100:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "41C14CC9-C244-4B86-AEA6-C50BAD5DA9A6",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3100-z:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "D14D4B4E-120E-4607-A4F1-447C7BF3052E",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3100v:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "15702ACB-29F3-412D-8805-E107E0729E35",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3200:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "32A532C0-B0E3-484A-B356-88970E7D0248",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3400:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "43913A0E-50D5-47DD-94D8-DD3391633619",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3500:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "A8E1073F-D374-4311-8F12-AD8C72FAA293",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3524-x:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "10F80A72-AD54-4699-B8AE-82715F0B58E2",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3524-xl:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "9354B6A2-D7D6-442E-BF4C-FE8A336D9E94",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3548-x:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "74CB4002-7636-4382-B33E-FBA060A13C34",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3548-xl:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "10CEBF73-3EE0-459A-86C5-F8F6243FE27C",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9000:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "8EBEBA5B-5589-417B-BF3B-976083E9FE54",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9200:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "532CE4B0-A3C9-4613-AAAF-727817D06FB4",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9300:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "92E2CB2B-DA11-4CF7-9D57-3D4D48990DC0",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9500:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "63BE0266-1C00-4D6A-AD96-7F82532ABAA7",
                     vulnerable: false,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
         operator: "AND",
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:cisco:nx_os:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "7F7EB3C5-C1B9-4B0A-844D-C5BFD42687EE",
                     versionEndExcluding: "7.0\\(3\\)f3\\(5\\)",
                     versionStartIncluding: "7.0\\(3\\)",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3600:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "97217080-455C-48E4-8CE1-6D5B9485864F",
                     vulnerable: false,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
         operator: "AND",
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "A vulnerability in the Remote Package Manager (RPM) subsystem of Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to leverage a time-of-check, time-of-use (TOCTOU) race condition to corrupt local variables, which could lead to arbitrary command injection. The vulnerability is due to the lack of a proper locking mechanism on critical variables that need to stay static until used. An attacker could exploit this vulnerability by authenticating to an affected device and issuing a set of RPM-related CLI commands. A successful exploit could allow the attacker to perform arbitrary command injection. The attacker would need administrator credentials for the targeted device.",
      },
      {
         lang: "es",
         value: "Una vulnerabilidad en el subsistema Remote Package Manager (RPM) del software NX-OS de Cisco podría permitir que un atacante local autorizado con credenciales de administrador explote una condición de carrera de tiempo de comprobación (TOCTOU) para corromper las variables locales , lo que podría dar lugar a una inyección de mando arbitraria. La vulnerabilidad se debe a la falta de un mecanismo de bloqueo adecuado en las variables críticas que deben permanecer estáticas hasta su uso. Un atacante podría explotar esta vulnerabilidad identificandose en un dispositivo afectado y emitiendo un conjunto de comandos CLI relacionados con RPM. Un ataque con éxito podría permitir al atacante realizar una inyección de comando arbitraria. El atacante podría necesitar credenciales de administrador para el dispositivo de destino.",
      },
   ],
   id: "CVE-2019-1732",
   lastModified: "2024-11-21T04:37:12.157",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "LOCAL",
               authentication: "NONE",
               availabilityImpact: "COMPLETE",
               baseScore: 6.9,
               confidentialityImpact: "COMPLETE",
               integrityImpact: "COMPLETE",
               vectorString: "AV:L/AC:M/Au:N/C:C/I:C/A:C",
               version: "2.0",
            },
            exploitabilityScore: 3.4,
            impactScore: 10,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "HIGH",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 6.4,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "HIGH",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 0.5,
            impactScore: 5.9,
            source: "psirt@cisco.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "HIGH",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 6.4,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "HIGH",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 0.5,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2019-05-15T17:29:01.843",
   references: [
      {
         source: "psirt@cisco.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/108361",
      },
      {
         source: "psirt@cisco.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-rpm-injec",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/108361",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-rpm-injec",
      },
   ],
   sourceIdentifier: "psirt@cisco.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-78",
            },
         ],
         source: "psirt@cisco.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-667",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}