Executive Summary
Summary | |
---|---|
Title | Brocade BigIron RX switch ACL bypass vulnerability |
Informations | |||
---|---|---|---|
Name | VU#853246 | First vendor Publication | 2011-07-13 |
Vendor | VU-CERT | Last vendor Modification | 2011-08-28 |
Severity (Vendor) | N/A | Revision | M |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:L/Au:N/C:N/I:P/A:N) | |||
---|---|---|---|
Cvss Base Score | 5 | Attack Range | Network |
Cvss Impact Score | 2.9 | Attack Complexity | Low |
Cvss Expoit Score | 10 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Vulnerability Note VU#853246Brocade BigIron RX switch ACL bypass vulnerabilityOverviewBrocade BigIron RX switch devices are susceptible to an access control list (ACL) bypass vulnerability by sending packets with the source port 179.I. DescriptionBrocade BigIron RX switch devices do not properly restricted packets sent with a source port of 179. Port 179 is commonly used for Border Gateway Protocol (BGP) communication. It has been reported that individual packets with a source port of 179 are allowed through, as well as, full SSH and RDP sessions.II. ImpactA remote unauthenticated attacker can bypass any ACL rule on a BigIron RX switch device.III. SolutionApply an UpdateBrocade has created software defect 355173 for this issue. The following patch releases address this vulnerability; RX 2.8.00a, 2.7.03b, and 2.7.02l. Customers should contact Brocade support to download these updates.
Referenceshttp://www.brocade.com/products/all/switches/product-details/bigiron-rx-series/index.page Thanks to Bashar Ewaida for reporting this vulnerability. This document was written by Jared Allar.
|
Original Source
Url : http://www.kb.cert.org/vuls/id/853246 |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-264 | Permissions, Privileges, and Access Controls |
CPE : Common Platform Enumeration
Type | Description | Count |
---|---|---|
Hardware | 1 |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
73869 | Brocade BigIron RX Switches Access Control List Remote Bypass |