bugtraq - Cisco Security Advisory: Cisco Application Policy Infrastructure Controller Access Control Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 22 Jul 2015 12:00:37 -0400
From: Cisco Systems Product Security Incident Response Team <psirt@...co.com>
To: bugtraq@...urityfocus.com
Cc: psirt@...co.com
Subject: Cisco Security Advisory: Cisco Application Policy Infrastructure Controller Access Control Vulnerability

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Cisco Security Advisory: Cisco Application Policy Infrastructure Controller Access Control Vulnerability

Advisory ID: cisco-sa-20150722-apic

Revision 1.0

For Public Release 2015 July 22 16:00  UTC (GMT) 

-----------------------------------------------------------------------------------------

Summary
=======

A vulnerability in the cluster management configuration of the Cisco Application Policy Infrastructure Controller (APIC) and the Cisco Nexus 9000 Series ACI Mode Switch could allow an authenticated, remote attacker to access the APIC as the root user.

The vulnerability is due to improper implementation of access controls in the APIC filesystem. An attacker could exploit this vulnerability by accessing the cluster management configuration of the APIC. An exploit could allow the attacker to gain access to the APIC as the root user and perform root-level commands.

Cisco has released software updates that address this vulnerability. 

This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150722-apic
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - http://gpgtools.org

iQIcBAEBCgAGBQJVrtbDAAoJEIpI1I6i1Mx3btoP/2ab0rglGwG9K0DZbKgg/uk0
v7hAZl9ZAjFJj61v0R5byP286xSMvn6MXz1Jr44epjPF2a3ej4aR01gyTvMO6DUD
UGmheZFvsmbrfd2sqRFHF/x1g2bOIdYq4i7z0BVP9YXJ4T3WR5FE3DxXt1VqZiTK
ywNIWfwDv73LwEJrsSa+z3Z7pT3LxPBavBgtvzjUDizqW8zrpGS+KeMw8ol4Xz4p
VVMtTo4DfXphaC2UiAtzP4UnJl3AQXCKNzYRAU56XxrqlkgQxQg2ZnrP7fJvTXET
U2eHf4pQXkG2+BKl2gCc2onQqdeXmitlFyTlGIZbiJ/iLAY6oxy3SUT4gVZdMUXf
O7BU5rA99maZq65+Ziu/bKuCe1AilKSg4TiSjhu0fIKbiMu1b9mqrgv4n9KaTtWY
UdpiKJGtQQQrrI6r1gZeEIZ2K2/ybMBT3nRm+avD+omRa4R5HX1V+BhWksPF3eA6
H+xtN/pBIBs7ecahWRcdqu9pY76Re/JCtIrlLCHNfBMi6PPEcnUjaE4RpWaumnBO
sCPEp8t0leACiCP11M2ZjMFm6GfrTDTF04AYP+VkAWYXNcfNSxp6MoC4Ee1ygb1/
2ywXDFpFPj4XIwKIgyE6k76ND5r2WuK1e1VEuW4jikGYeeCQ3nmrJFHDc/mmyAum
0emrgf0YLmkfmXrYzv0u
=zm4G
-----END PGP SIGNATURE-----