CVE:CVE-2019-1593
CNNVD:CNNVD-201903-174
Cisco Nexus 9500 R-Series Line Cards and Fabric Modules等都是美国思科（Cisco）公司的产品。Cisco Nexus 9500 R-Series Line Cards and Fabric Modules是一款9500R系列线卡模块。Cisco Nexus 3000 Series Switches是一款3000系列交换机。Cisco Nexus 3500 Platform Switches是一款3500系列平台交换机。Cisco NX-OS Software是一套交换机使用的数据中心级操作系统软件。
Cisco NX-OS Software中的Bash shell的实现存在权限许可和访问控制漏洞，该漏洞源于程序错误地实现了Bash shell命令。本地攻击者可通过向设备进行身份验证并向Bash弹出窗口注入特制的命令利用该漏洞将权限提升至管理员权限。以下产品受到影响：Cisco Nexus 3000 Series Switches；Nexus 3500 Platform Switches；Nexus 3600 Platform Switches；Nexus 7000 Series Switches；Nexus 7700 Series Switches；Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode；Nexus 9000 Series Switches in standalone NX-OS mode；Nexus 9500 R-Series Line Cards and Fabric Modules。
solution:Upgrade cisco nx-os to a higher version than 7.0\(3\i7\(4\,7.0\(3\i4\(9\,7.0\(3\i7\(4\,7.0\(3\f3\(5\,8.2\(3\,8.3\(1\,13.2\(4d\,14.0\(1h\,and avoid the version [7.0\(3\)i5,7.0\(3\)i7\(4\)),[7.0\(3\)i4,7.0\(3\)i4\(9\)),[7.0\(3\),7.0\(3\)i7\(4\)),[7.0\(3\),7.0\(3\)f3\(5\)),[8.1,8.2\(3\)),[8.3,8.3\(1\)),(,13.2\(4d\)),[14.0,14.0\(1h\))