Vulnerability CVE-2018-6438

Vulnerability Name:

CVE-2018-6438 (CCN-152800)

Assigned:

2018-10-29

Published:

2018-10-29

Updated:

2021-06-22

Summary:

A Vulnerability in the supportsave command of Brocade Fabric OS command line interface (CLI) versions before 8.2.1, 8.1.2f, 8.0.2f, 7.4.2d could allow a local attacker to escape the restricted shell and, gain root access.

CVSS v3 Severity:

7.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
6.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

8.4 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
7.3 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

7.2 High (CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

7.2 High (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

Vulnerability Type:

CWE-noinfo

Vulnerability Consequences:

Gain Privileges

References:

Source: MITRE
Type: CNA
CVE-2018-6438

Source: CCN
Type: IBM Security Bulletin 888177 (Flex System FC5022 16Gb SAN Scalable Switch Firmware)
Brocade Fabric OS (FOS) Advisory vulnerabilities affect Brocade 8Gb SAN Switch Module for BladeCenter and IBM Flex System FC5022 16Gb SAN Scalable Switch

Source: XF
Type: UNKNOWN
broadcom-cve20186438-priv-esc(152800)

Source: CCN
Type: Brocade Security Advisory ID: BSA-2018- 731
Brocade Fabric OS

Source: CONFIRM
Type: Vendor Advisory
https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2018-731

Vulnerable Configuration:

Configuration 1:

cpe:/o:broadcom:fabric_operating_system:*:*:*:*:*:*:*:* (Version >= 8.1.2 and < 8.1.2f)

OR cpe:/o:broadcom:fabric_operating_system:*:*:*:*:*:*:*:* (Version >= 8.2.0 and < 8.2.1)

OR cpe:/o:broadcom:fabric_operating_system:*:*:*:*:*:*:*:* (Version >= 8.0.2 and < 8.0.2f)

OR cpe:/o:broadcom:fabric_operating_system:*:*:*:*:*:*:*:* (Version >= 7.4.2 and < 7.4.2d)

Denotes that component is vulnerable

BACK