PT-2013-1661 · Cisco · Cisco Nx-Os+1

Published 2013-10-05 · Updated 2016-09-22 · CVE-2012-4141

Positive Technologies (AI Summary)

CVSS v2.0

6.2

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Cisco NX-OS (affected versions not specified)

Description A directory traversal issue in the CLI parser of Cisco NX-OS allows local users to create arbitrary script files via a relative pathname in the file name parameter. This is due to improper input filtering of file name input. An attacker could exploit this by including a relative path in the file name parameter, potentially allowing them to write arbitrary scripts to any part of the file system. The attacker requires authenticated access to the targeted system, which may limit the likelihood of a successful exploit.

Recommendations To resolve the issue, update to a version of Cisco NX-OS that includes the fix for this vulnerability. As a temporary workaround, consider restricting access to the CLI parser or limiting the ability to create files in sensitive locations until a patch is available. Avoid using relative pathnames in the file name parameter until the issue is resolved.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-4141

Affected Products

Cisco Nx-Os

Cisco Nexus

References · 6

• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-4141 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-4141 · Security Note
• http://osvdb.org/98122 · Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20131008-CVE-2012-4141 · Note
• http://securitytracker.com/id/1029160 · Note
• http://securityfocus.com/bid/62839 · Note