CVE-2017-6639

Una vulnerabilidad en la funcionalidad role-based access control (RBAC) de Prime Data Center Network Manager (DCNM) de Cisco, podría permitir a un atacante remoto no identificado acceder a información confidencial o ejecutar código arbitrario con privilegios root en un sistema afectado. La vulnerabilidad es debido a la falta de mecanismos de identificación y autorización para una herramienta de depuración que se habilitó inadvertidamente en el software afectado. Un atacante podría explotar esta vulnerabilidad mediante la conexión remota a la herramienta de depuración por medio de TCP. Una explotación con éxito podría permitir al atacante acceder a información confidencial sobre el software afectado o ejecutar código arbitrario con privilegios root en el sistema afectado. Esta vulnerabilidad afecta al Programa Prime Data Center Network Manager (DCNM) de Cisco versiones 10.1(1) y 10.1(2) para plataformas de Microsoft Windows, Linux y Virtual Appliance. ID de bug de Cisco: CSCvd09961.

HPE StoreFabric C-series Switch Software uses Ciscos Prime Data Center Network Manager (DCNM). Cisco has identified a remote code execution vulnerability in two versions of Cisco Prime Data Center Network Manager (DCNM) which HPE had included for download for customers under contract from the HPE Support Center. The affected versions of DCNM are 10.1(1) and 10.1(2). HPE bundled these DCNM versions with the following MDS and Nexus firmware downloads: * MDS 7.3(0)DY(1), released February 2017 * MDS 7.3(1)DY(1), released April 2017 * Nexus 5.2(1)N1(9b), released May 2017 **Note:** A vulnerability in the role-based access control (RBAC) functionality of Cisco Prime Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to access sensitive information or execute arbitrary code with root privileges on an affected system. The vulnerability is due to the lack of authentication and authorization mechanisms for a debugging tool that was inadvertently enabled in the affected software. An attacker could exploit this vulnerability by remotely connecting to the debugging tool via TCP. A successful exploit could allow the attacker to access sensitive information about the affected software or execute arbitrary code with root privileges on the affected system. Revision 1 of this advisory.