PT-2016-3223 · Brocade · Brocade Network Advisor

Rgod · Published 2016-10-17 · Updated 2018-05-10 · CVE-2016-8205

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Brocade Network Advisor versions prior to and including 14.0.2

Description The issue exists due to incorrect restriction of the path name to a directory with limited access in the DashboardFileReceiveServlet of the Brocade Network Advisor system. This could allow a remote attacker to upload a malicious file to a section of the file system where it can be executed.

Recommendations For Brocade Network Advisor versions prior to and including 14.0.2, update to a version later than 14.0.2 to resolve the issue. As a temporary workaround, consider restricting access to the DashboardFileReceiveServlet to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2017-02598

CVE-2016-8205

ZDI-17-050

Affected Products

Brocade Network Advisor

References · 9

• https://zerodayinitiative.com/advisories/ZDI-17-050 · Security Note
• https://osv.dev/vulnerability/CVE-2016-8205 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-8205 · Security Note
• https://bdu.fstec.ru/vul/2017-02598 · Security Note
• http://zerodayinitiative.com/advisories/ZDI-17-050 · Note
• https://broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2017-178 · Note
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03785en_us · Note
• http://securityfocus.com/bid/95694 · Note
• https://brocade.com/content/dam/common/documents/content-types/security-bulletin/brocade-security-advisory-2016-178.htm · Note