PT-2017-12506 · Cisco · Cisco Nx-Os System+1

Publicado 2017-11-29 · Atualizado 2019-10-03 · CVE-2017-12340

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cisco NX-OS System Software (affected versions not specified)

Description A vulnerability in Cisco NX-OS System Software could allow an authenticated, local attacker to access the Bash shell of an affected device's operating system, even if the Bash shell is disabled on the system. The issue is due to insufficient sanitization of user-supplied parameters passed to certain functions of the Python scripting sandbox. An attacker could exploit this vulnerability to escape the scripting sandbox and enter the Bash shell of the operating system with the privileges of the authenticated user. To exploit this vulnerability, the attacker must have local access to the affected system and be authenticated to the affected system with administrative or Python execution privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Improper Encoding or Escaping of Output

Enumeração de Fraquezas

CWE-284

CWE-116

Identificadores relacionados

CVE-2017-12340

Produtos afetados

Cisco Nx-Os System

Cisco Nexus

Referências · 4

• https://osv.dev/vulnerability/CVE-2017-12340 · Aviso do Fabricante
• http://securityfocus.com/bid/102069 · Nota
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171129-switch · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-12340 · Nota de Segurança