PT-2013-1661 · Cisco · Cisco Nx-Os+1

Publicado 2013-10-05 · Atualizado 2016-09-22 · CVE-2012-4141

Positive Technologies (AI Summary)

CVSS v2.0

6.2

Média

Vetor base

AV:L/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Cisco NX-OS (affected versions not specified)

Description A directory traversal issue in the CLI parser of Cisco NX-OS allows local users to create arbitrary script files via a relative pathname in the file name parameter. This is due to improper input filtering of file name input. An attacker could exploit this by including a relative path in the file name parameter, potentially allowing them to write arbitrary scripts to any part of the file system. The attacker requires authenticated access to the targeted system, which may limit the likelihood of a successful exploit.

Recommendations To resolve the issue, update to a version of Cisco NX-OS that includes the fix for this vulnerability. As a temporary workaround, consider restricting access to the CLI parser or limiting the ability to create files in sensitive locations until a patch is available. Avoid using relative pathnames in the file name parameter until the issue is resolved.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2012-4141

Produtos afetados

Cisco Nx-Os

Cisco Nexus

Referências · 6

• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-4141 · Aviso do Fabricante
• http://osvdb.org/98122 · Nota
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20131008-CVE-2012-4141 · Nota
• http://securitytracker.com/id/1029160 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-4141 · Nota de Segurança
• http://securityfocus.com/bid/62839 · Nota