Freely subscribe to our NEWSLETTER

This bulletin was written by Vigil@nce : http://vigilance.fr/offer

SYNTHESIS OF THE VULNERABILITY

An attacker can use special characters in commands for Cisco
NX-OS, in order to get a system shell.

– Impacted products: Cisco Nexus, NX-OS.
– Severity: 2/4.
– Creation date: 02/07/2015.

DESCRIPTION OF THE VULNERABILITY

The Cisco NX-OS product offers a command line interface for
administration purpose.

This interface may be used to run commands that handles filenames.
However, the command line parser does not suitably handles special
characters as far as filenames are concerned. So, an attacker can
create files in the system, with an arbitrary content; then use
them to get a system shell.

This vulnerability looks like the one described in
VIGILANCE-VUL-17281, but the exploitation method is likely
different.

An attacker can therefore use special characters in commands for
Cisco NX-OS, in order to get a system shell.

ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN

http://vigilance.fr/vulnerability/Cisco-NX-OS-escape-to-the-system-shell-17297