PT-2016-3224 · Brocade · Brocade Network Advisor

Rgod · Published 2016-10-17 · Updated 2020-01-21 · CVE-2016-8204

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Brocade Network Advisor versions prior to and including 14.0.2

Description A Directory Traversal issue in the FileReceiveServlet of Brocade Network Advisor could allow remote attackers to upload a malicious file in a section of the file system where it can be executed. The vulnerability exists due to incorrect restriction of the directory path name with limited access. Exploitation of the vulnerability may allow a remote attacker to upload a malicious file to an area of the file system where it can be executed.

Recommendations For Brocade Network Advisor versions prior to and including 14.0.2, update to a version later than 14.0.2 to resolve the issue. As a temporary workaround, consider restricting access to the FileReceiveServlet to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2017-02599

CVE-2016-8204

ZDI-17-049

Affected Products

Brocade Network Advisor

References · 9

• https://osv.dev/vulnerability/CVE-2016-8204 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-17-049 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-8204 · Security Note
• https://bdu.fstec.ru/vul/2017-02599 · Security Note
• https://broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2017-177 · Vendor Advisory
• http://zerodayinitiative.com/advisories/ZDI-17-049 · Note
• https://brocade.com/content/dam/common/documents/content-types/security-bulletin/brocade-security-advisory-2016-177.htm · Note
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03785en_us · Note
• http://securityfocus.com/bid/95695 · Note