PT-2015-2235 · Cisco · Cisco Nx-Os+1

Published 2015-06-30 · Updated 2016-12-28 · CVE-2015-4231

Positive Technologies (AI Summary)

CVSS v2.0

3.6

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cisco NX-OS version 6.2(8a)

Description The issue is related to incomplete privilege separation of the Python scripting engine across multiple virtual device contexts (VDCs) in Cisco NX-OS. This allows an attacker with administrative privileges in one VDC to bypass access restrictions and delete files owned by a different VDC, potentially leading to a denial of service (DoS) condition. The vulnerability can be exploited by an authenticated, local attacker with administrative privileges in a specific VDC.

Recommendations For Cisco NX-OS version 6.2(8a), at the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2015-11581

CVE-2015-4231

Affected Products

Cisco Nx-Os

Cisco Nexus

References · 5

• http://tools.cisco.com/security/center/viewAlert.x?alertId=39568 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-11581 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-4231 · Security Note
• http://securitytracker.com/id/1032763 · Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20150630-CVE-2015-4231 · Note