CVE-2015-4232 : Cisco NX-OS 6.2(10) on Nexus and MDS 9000 devices allows local users to execute

Cisco NX-OS 6.2(10) on Nexus and MDS 9000 devices allows local users to execute arbitrary OS commands by entering crafted tar parameters in the CLI, aka Bug ID CSCus44856.

Published 2015-07-03 10:59:01

Updated 2016-12-28 17:18:23

Source Cisco Systems, Inc.

View at NVD, CVE.org

Products affected by CVE-2015-4232

Cisco » Nx-os » Version: 6.2(10)
cpe:2.3:o:cisco:nx-os:6.2\(10\):*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Mds 9100 » Version: N/A
When used together with: Cisco » Mds 9200 » Version: N/A
When used together with: Cisco » Mds 9500 » Version: N/A
When used together with: Cisco » Mds 9700 » Version: N/A
When used together with: Cisco » Nexus 93120tx » Version: N/A
When used together with: Cisco » Nexus 93128tx » Version: N/A
When used together with: Cisco » Nexus 9332pq » Version: N/A
When used together with: Cisco » Nexus 9336pq Aci Spine » Version: N/A
When used together with: Cisco » Nexus 9372px » Version: N/A
When used together with: Cisco » Nexus 9372tx » Version: N/A
When used together with: Cisco » Nexus 9396px » Version: N/A
When used together with: Cisco » Nexus 9396tx » Version: N/A
When used together with: Cisco » Nexus 9504 » Version: N/A
When used together with: Cisco » Nexus 9508 » Version: N/A
When used together with: Cisco » Nexus 9516 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2015-4232

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 6 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2015-4232

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
4.6	MEDIUM	AV:L/AC:L/Au:N/C:P/I:P/A:P	3.9	6.4	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial

CWE ids for CVE-2015-4232

CWE-264

Assigned by: nvd@nist.gov (Primary)

References for CVE-2015-4232

http://www.securityfocus.com/bid/75503

Cisco NX-OS Software for Nexus Series CVE-2015-4232 Local Privilege Escalation Vulnerability
Third Party Advisory;VDB Entry
http://www.securitytracker.com/id/1032764

Cisco NX-OS 'tar' Command Validation Flaw Lets Local Users Gain Elevated Privileges - SecurityTracker
Third Party Advisory;VDB Entry
http://tools.cisco.com/security/center/viewAlert.x?alertId=39569

Cisco Nexus Devices NX-OS Software Command-Line Interpreter Local Privilege Escalation Vulnerability
Vendor Advisory

Jump to

Vulnerability Details : CVE-2015-4232

Products affected by CVE-2015-4232

Exploit prediction scoring system (EPSS) score for CVE-2015-4232

CVSS scores for CVE-2015-4232

CWE ids for CVE-2015-4232

References for CVE-2015-4232