PT-2021-7527 · Brocade · Brocade Fabric Os

Published 2021-07-14 · Updated 2021-08-23 · CVE-2021-27793

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Brocade Fabric OS versions prior to 8.2.3a and after 8.2.0 Brocade Fabric OS versions prior to 9.0.1b and after 9.0.0

Description The issue is related to the implementation of the aaa tacacs+ protocol in Brocade Fabric OS, which has weaknesses in its authorization mechanism. This can be exploited by a remote attacker to cause a denial of service. The problem manifests as intermittent authorization failures, potentially preventing users with valid accounts from logging into the switch.

Recommendations For Brocade Fabric OS versions prior to 8.2.3a and after 8.2.0, update to version 8.2.3a or later to resolve the issue. For Brocade Fabric OS versions prior to 9.0.1b and after 9.0.0, update to version 9.0.1b or later to resolve the issue.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2022-07246

CVE-2021-27793

Affected Products

Brocade Fabric Os

References · 7

• https://bdu.fstec.ru/vul/2022-07246 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-27793 · Security Note
• https://osv.dev/vulnerability/CVE-2021-27793 · Vendor Advisory
• https://broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2021-1553 · Vendor Advisory
• https://security.netapp.com/advisory/ntap-20210819-0001 · Note
• https://t.me/cvenotify/19223 · Telegram Post
• https://t.me/cibsecurity/27229 · Telegram Post