CVE-2019-1732

A vulnerability in the Remote Package Manager (RPM) subsystem of Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to leverage a time-of-check, time-of-use (TOCTOU) race condition to corrupt local variables, which could lead to arbitrary command injection. The vulnerability is due to the lack of a proper locking mechanism on critical variables that need to stay static until used. An attacker could exploit this vulnerability by authenticating to an affected device and issuing a set of RPM-related CLI commands. A successful exploit could allow the attacker to perform arbitrary command injection. The attacker would need administrator credentials for the targeted device.

A vulnerability in the Remote Package Manager (RPM) subsystem of Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to leverage a time-of-check, time-of-use (TOCTOU) race condition to corrupt local variables, which could lead to arbitrary command injection. The vulnerability is due to the lack of a proper locking mechanism on critical variables that need to stay static until used. An attacker could exploit this vulnerability by authenticating to an affected device and issuing a set of RPM-related CLI commands. A successful exploit could allow the attacker to perform arbitrary command injection. The attacker would need administrator credentials for the targeted device.

Una vulnerabilidad en el subsistema Remote Package Manager (RPM) del software NX-OS de Cisco podría permitir que un atacante local autorizado con credenciales de administrador explote una condición de carrera de tiempo de comprobación (TOCTOU) para corromper las variables locales , lo que podría dar lugar a una inyección de mando arbitraria. La vulnerabilidad se debe a la falta de un mecanismo de bloqueo adecuado en las variables críticas que deben permanecer estáticas hasta su uso. Un atacante podría explotar esta vulnerabilidad identificandose en un dispositivo afectado y emitiendo un conjunto de comandos CLI relacionados con RPM. Un ataque con éxito podría permitir al atacante realizar una inyección de comando arbitraria. El atacante podría necesitar credenciales de administrador para el dispositivo de destino.