csaf_certbund - WID-SEC-W-2023-0074

WID-SEC-W-2023-0074

Vulnerability from csaf_certbund - Published: 2023-01-11 23:00 - Updated: 2023-01-11 23:00

Summary

Cisco Network Services Orchestrator: Schwachstelle ermöglicht Manipulation von Dateien und Denial of Service

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung

Network Services Orchestrator (NSO) verbindet Tools zur Netzwerkautomatisierung und -orchestrierung mit der zugrunde liegenden physischen und virtuellen Infrastruktur.

Angriff

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Cisco Network Services Orchestrator ausnutzen, um Dateien zu manipulieren und einen Denial of Service Zustand zu verursachen.

Betroffene Betriebssysteme

- CISCO Appliance

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Network Services Orchestrator (NSO) verbindet Tools zur Netzwerkautomatisierung und -orchestrierung mit der zugrunde liegenden physischen und virtuellen Infrastruktur.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Cisco Network Services Orchestrator ausnutzen, um Dateien zu manipulieren und einen Denial of Service Zustand zu verursachen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- CISCO Appliance",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2023-0074 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-0074.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2023-0074 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-0074"
      },
      {
        "category": "external",
        "summary": "Cisco Security Advisory vom 2023-01-11",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nso-path-trvsl-zjBeMkZg"
      }
    ],
    "source_lang": "en-US",
    "title": "Cisco Network Services Orchestrator: Schwachstelle erm\u00f6glicht Manipulation von Dateien und Denial of Service",
    "tracking": {
      "current_release_date": "2023-01-11T23:00:00.000+00:00",
      "generator": {
        "date": "2024-08-15T17:41:18.094+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.5"
        }
      },
      "id": "WID-SEC-W-2023-0074",
      "initial_release_date": "2023-01-11T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2023-01-11T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Cisco Network Services Orchestrator \u003c 5.4.7",
                "product": {
                  "name": "Cisco Network Services Orchestrator \u003c 5.4.7",
                  "product_id": "T025807",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:cisco:network_services_orchestrator:5.4.7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Cisco Network Services Orchestrator \u003c 5.5.6",
                "product": {
                  "name": "Cisco Network Services Orchestrator \u003c 5.5.6",
                  "product_id": "T025808",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:cisco:network_services_orchestrator:5.5.6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Cisco Network Services Orchestrator \u003c 5.6.7",
                "product": {
                  "name": "Cisco Network Services Orchestrator \u003c 5.6.7",
                  "product_id": "T025809",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:cisco:network_services_orchestrator:5.6.7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Cisco Network Services Orchestrator \u003c 5.7.4",
                "product": {
                  "name": "Cisco Network Services Orchestrator \u003c 5.7.4",
                  "product_id": "T025810",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:cisco:network_services_orchestrator:5.7.4"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Cisco Network Services Orchestrator \u003c 5.8.1",
                "product": {
                  "name": "Cisco Network Services Orchestrator \u003c 5.8.1",
                  "product_id": "T025811",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:cisco:network_services_orchestrator:5.8.1"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Network Services Orchestrator"
          }
        ],
        "category": "vendor",
        "name": "Cisco"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-20040",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in Cisco Network Services Orchestrator. Der Fehler besteht, weil die vom Benutzer bereitgestellten Eingaben nicht ordnungsgem\u00e4\u00df \u00fcberpr\u00fcft werden, wenn NETCONF zum Hochladen von Paketen auf ein betroffenes Ger\u00e4t verwendet wird. Ein entfernter, authentisierter Angreifer mit bestimmten Rechten kann diese Schwachstelle ausnutzen, indem er eine speziell pr\u00e4parierte Paketdatei hochl\u00e4dt, um Dateien an beliebige Stellen im Dateisystem zu schreiben oder beliebige Dateien aus dem Dateisystem eines betroffenen Ger\u00e4ts zu l\u00f6schen, was zu einem Denial of Service-Zustand f\u00fchrt."
        }
      ],
      "release_date": "2023-01-11T23:00:00.000+00:00",
      "title": "CVE-2023-20040"
    }
  ]
}

CVE-2023-20040 (GCVE-0-2023-20040)

Vulnerability from cvelistv5 – Published: 2023-01-19 01:37 – Updated: 2024-08-02 08:57

Summary

A vulnerability in the NETCONF service of Cisco Network Services Orchestrator (NSO) could allow an authenticated, remote attacker to cause a denial of service (DoS) on an affected system that is running as the root user. To exploit this vulnerability, the attacker must be a member of the admin group. This vulnerability exists because user-supplied input is not properly validated when NETCONF is used to upload packages to an affected device. An attacker could exploit this vulnerability by uploading a specially crafted package file. A successful exploit could allow the attacker to write crafted files to arbitrary locations on the filesystem or delete arbitrary files from the filesystem of an affected device, resulting in a DoS condition. Note: By default, during install, Cisco NSO will be set up to run as the root user unless the --run-as-user option is used.

Severity ?

5.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H

CWE

CWE-23 - Relative Path Traversal

Assigner

cisco

References

URL

Tags

https://sec.cloudapps.cisco.com/security/center/c…

Impacted products

	Vendor	Product	Version
	Cisco	Cisco Network Services Orchestrator	Affected: 4.7.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T08:57:35.576Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "cisco-sa-nso-path-trvsl-zjBeMkZg",
            "tags": [
              "x_transferred"
            ],
            "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nso-path-trvsl-zjBeMkZg"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Cisco Network Services Orchestrator",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "4.7.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the NETCONF service of Cisco Network Services Orchestrator (NSO) could allow an authenticated, remote attacker to cause a denial of service (DoS) on an affected system that is running as the root user. To exploit this vulnerability, the attacker must be a member of the admin group.\r\n\r This vulnerability exists because user-supplied input is not properly validated when NETCONF is used to upload packages to an affected device. An attacker could exploit this vulnerability by uploading a specially crafted package file. A successful exploit could allow the attacker to write crafted files to arbitrary locations on the filesystem or delete arbitrary files from the filesystem of an affected device, resulting in a DoS condition. \r\n\r Note: By default, during install, Cisco NSO will be set up to run as the root user unless the --run-as-user option is used."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-23",
              "description": "Relative Path Traversal",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-25T16:57:36.087Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-nso-path-trvsl-zjBeMkZg",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nso-path-trvsl-zjBeMkZg"
        }
      ],
      "source": {
        "advisory": "cisco-sa-nso-path-trvsl-zjBeMkZg",
        "defects": [
          "CSCwb11065"
        ],
        "discovery": "INTERNAL"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2023-20040",
    "datePublished": "2023-01-19T01:37:34.592Z",
    "dateReserved": "2022-10-27T18:47:50.316Z",
    "dateUpdated": "2024-08-02T08:57:35.576Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

WID-SEC-W-2023-0074

CVE-2023-20040 (GCVE-0-2023-20040)

Tags

Sightings

Nomenclature