PT-2013-1656 · Cisco+1 · Cisco Nx-Os+2

Published 2013-10-08 · Updated 2013-10-16 · CVE-2012-4121

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco NX-OS (affected versions not specified)

Description A vulnerability in the Stream Editor (sed) command-line filter could allow an authenticated, local attacker to read and write arbitrary files due to an input validation issue. The attacker could exploit this by using the sed r and w commands. A successful exploit could result in a complete compromise of the affected device. The attacker requires authenticated access to the targeted system, which may limit the likelihood of a successful exploit.

Recommendations To resolve the issue, update to a version of Cisco NX-OS Software that has the fix for this vulnerability. As a temporary workaround, consider restricting the use of the sed command with r and w options until a patch is available.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-4121

Affected Products

Cisco Nx-Os

Cisco Nexus

Sed

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2012-4121 · Security Note
• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-4121 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20131008-CVE-2012-4121 · Note