PT-2015-3046 · Cisco · Cisco Firepower Extensible Operating System

Publicado 2015-11-19 · Atualizado 2015-11-19 · CVE-2015-6370

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Firepower Extensible Operating System version 1.1(1.160)

Description The issue exists due to the failure to neutralize special elements used in the operating system command. This allows a local attacker to execute arbitrary operating system commands as the root user by entering special command-line parameters. The Management I/O (MIO) component is affected, enabling local users to execute arbitrary OS commands as root via crafted CLI input.

Recommendations For Cisco Firepower Extensible Operating System version 1.1(1.160), consider restricting access to the MIO component to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using crafted CLI input that could lead to the execution of arbitrary OS commands.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

BDU:2016-00251

CVE-2015-6370

Produtos afetados

Cisco Firepower Extensible Operating System

Referências · 3

• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151116-fire1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-6370 · Nota de Segurança
• https://bdu.fstec.ru/vul/2016-00251 · Nota de Segurança