PT-2016-3223 · Brocade · Brocade Network Advisor

Rgod · Publicado 2016-10-17 · Atualizado 2018-05-10 · CVE-2016-8205

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Brocade Network Advisor versions prior to and including 14.0.2

Description The issue exists due to incorrect restriction of the path name to a directory with limited access in the DashboardFileReceiveServlet of the Brocade Network Advisor system. This could allow a remote attacker to upload a malicious file to a section of the file system where it can be executed.

Recommendations For Brocade Network Advisor versions prior to and including 14.0.2, update to a version later than 14.0.2 to resolve the issue. As a temporary workaround, consider restricting access to the DashboardFileReceiveServlet to minimize the risk of exploitation.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

BDU:2017-02598

CVE-2016-8205

ZDI-17-050

Produtos afetados

Brocade Network Advisor

Referências · 9

• http://zerodayinitiative.com/advisories/ZDI-17-050 · Nota
• https://zerodayinitiative.com/advisories/ZDI-17-050 · Nota de Segurança
• https://broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2017-178 · Nota
• https://osv.dev/vulnerability/CVE-2016-8205 · Aviso do Fabricante
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03785en_us · Nota
• http://securityfocus.com/bid/95694 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-8205 · Nota de Segurança
• https://brocade.com/content/dam/common/documents/content-types/security-bulletin/brocade-security-advisory-2016-178.htm · Nota
• https://bdu.fstec.ru/vul/2017-02598 · Nota de Segurança