PT-2015-1424 · Cisco · Cisco Ios

Published 2015-06-12 · Updated 2017-01-04 · CVE-2015-4185

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 15.2

Description The issue is related to the TCL interpreter component in Cisco IOS, which has inadequate access control to certain functions. This allows a local attacker to escalate privileges by executing a TCL script, potentially gaining level 15 privileges and allowing the execution of privileged commands. The vulnerability is due to an error when resetting vty privileges after running a TCL script. An attacker could exploit this by establishing a session with the affected device immediately after a TCL script has been run, requiring valid credentials and successful authentication to the device.

Recommendations For Cisco IOS version 15.2, update to a newer version that includes the fix for this issue, as confirmed by Cisco. As a temporary workaround, consider restricting access to the TCL script interpreter until a patch is available. Avoid establishing sessions with the device immediately after a TCL script has been run to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2015-10520

CVE-2015-4185

Affected Products

Cisco Ios

References · 6

• http://tools.cisco.com/security/center/viewAlert.x?alertId=39343 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-10520 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-4185 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20150612-CVE-2015-4185 · Note
• http://securitytracker.com/id/1032581 · Note
• http://securityfocus.com/bid/72310 · Note