PT-2013-4357 · Cisco · Cisco Nx-Os+1

Publicado 2013-07-09 · Atualizado 2013-08-20 · CVE-2013-3400

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco NX-OS on Nexus 1000V devices (affected versions not specified)

Description The issue allows local users to execute arbitrary commands via crafted arguments to the install license command. This is due to a failure to properly validate user-supplied input. An attacker could exploit this by providing crafted arguments to the install license command. The vulnerability can be exploited by authenticated, local attackers who have sufficient privileges to execute the vulnerable command.

Recommendations For all affected versions, update to a version that includes the fix for this issue, as confirmed by Cisco in their security notice. As a temporary workaround, consider restricting access to the install license command to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2013-3400

Produtos afetados

Cisco Nx-Os

Cisco Nexus

Referências · 4

• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-3400 · Aviso do Fabricante
• http://securitytracker.com/id/1028763 · Nota
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20130709-CVE-2013-3400 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-3400 · Nota de Segurança