CVE-2013-5556

The license-installation module on the Cisco Nexus 1000V switch 4.2(1)SV1(5.2b) and earlier for VMware vSphere, Cisco Nexus 1000V switch 5.2(1)SM1(5.1) for Microsoft Hyper-V, and Cisco Virtual Security Gateway 4.2(1)VSG1(1) for Nexus 1000V switches allows local users to gain privileges and execute arbitrary commands via crafted "install all iso" arguments, aka Bug ID CSCui21340.

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:L/Au:S/C:C/I:C/A:C

Exploitability : 3.1 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5556	Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=31774	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:h:cisco:nexus_1000v:4.2\(1\)vsg1\(1\):-:*:*:*:nexus_1000v:*:*

Configuration 2 (hide)

cpe:2.3:h:cisco:nexus_1000v:5.2\(1\)sm1\(5.1\):-:*:*:*:microsoft_hyper-v:*:*

Configuration 3 (hide)

OR	cpe:2.3:h:cisco:nexus_1000v::-::::vmware_vsphere::
	cpe:2.3:h:cisco:nexus_1000v:4.2\(1\)_sv1\(4\):-::::vmware_vsphere::*
	cpe:2.3:h:cisco:nexus_1000v:4.2\(1\)_sv1\(4a\):-::::vmware_vsphere::*
	cpe:2.3:h:cisco:nexus_1000v:4.2\(1\)_sv1\(4b\):-::::vmware_vsphere::*
	cpe:2.3:h:cisco:nexus_1000v:4.2\(1\)sv1\(5.1\):-::::vmware_vsphere::*
	cpe:2.3:h:cisco:nexus_1000v:4.2\(1\)sv1\(5.1a\):-::::vmware_vsphere::*
	cpe:2.3:h:cisco:nexus_1000v:4.2\(1\)sv1\(5.2\):-::::vmware_vsphere::*

History

No history.

Information

Published : 2013-11-18 03:55

Updated : 2023-12-10 11:16

NVD link : CVE-2013-5556

Mitre link : CVE-2013-5556

CVE.ORG link : CVE-2013-5556

JSON object : View

Products Affected

cisco

nexus_1000v

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2013-5556", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:S/C:C/I:C/A:C", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.1, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2013-11-18T03:55:06.040", "references": [{"url": "http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5556", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "http://tools.cisco.com/security/center/viewAlert.x?alertId=31774", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "The license-installation module on the Cisco Nexus 1000V switch 4.2(1)SV1(5.2b) and earlier for VMware vSphere, Cisco Nexus 1000V switch 5.2(1)SM1(5.1) for Microsoft Hyper-V, and Cisco Virtual Security Gateway 4.2(1)VSG1(1) for Nexus 1000V switches allows local users to gain privileges and execute arbitrary commands via crafted \"install all iso\" arguments, aka Bug ID CSCui21340."}, {"lang": "es", "value": "El m\u00f3dulo license-installation en el switch Cisco Nexus 1000V 4.2(1)SV1(5.2b) y anteriores para VMware vSphere, switch Cisco Nexus 1000V 5.2(1)SM1(5.1) para Microsoft Hyper-V, y Cisco Virtual Security Gateway 4.2(1)VSG1(1) para switches Nexus 1000V permite a usuarios locales obtener privilegios y ejecutar comandos arbitrarios a trav\u00e9s de argumentos \"install all iso\" manipulados, tambi\u00e9n conocido como Bug ID CSCui21340."}], "lastModified": "2013-11-20T17:40:09.883", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:cisco:nexus_1000v:4.2\\(1\\)vsg1\\(1\\):-:*:*:*:nexus_1000v:*:*", "vulnerable": true, "matchCriteriaId": "AA97328A-5DF2-4C01-99C4-1D24077A9A1F"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:cisco:nexus_1000v:5.2\\(1\\)sm1\\(5.1\\):-:*:*:*:microsoft_hyper-v:*:*", "vulnerable": true, "matchCriteriaId": "C6B1D4A5-9F33-487C-A798-096CA1F1B9D3"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:cisco:nexus_1000v:*:-:*:*:*:vmware_vsphere:*:*", "vulnerable": true, "matchCriteriaId": "73EFA484-4033-4868-A733-F65B02B7B752", "versionEndIncluding": "4.2\\(1\\)sv1\\(5.2b\\)"}, {"criteria": "cpe:2.3:h:cisco:nexus_1000v:4.2\\(1\\)_sv1\\(4\\):-:*:*:*:vmware_vsphere:*:*", "vulnerable": true, "matchCriteriaId": "64AD054B-953C-46F1-99A3-AB3DE35FE695"}, {"criteria": "cpe:2.3:h:cisco:nexus_1000v:4.2\\(1\\)_sv1\\(4a\\):-:*:*:*:vmware_vsphere:*:*", "vulnerable": true, "matchCriteriaId": "9C9675A0-9933-4EA9-991D-D3B6F775F88C"}, {"criteria": "cpe:2.3:h:cisco:nexus_1000v:4.2\\(1\\)_sv1\\(4b\\):-:*:*:*:vmware_vsphere:*:*", "vulnerable": true, "matchCriteriaId": "75BF9F0F-980B-4BD0-B48B-A8191B660889"}, {"criteria": "cpe:2.3:h:cisco:nexus_1000v:4.2\\(1\\)sv1\\(5.1\\):-:*:*:*:vmware_vsphere:*:*", "vulnerable": true, "matchCriteriaId": "719A5726-4049-4BDD-8BF9-41E2D8E8FF41"}, {"criteria": "cpe:2.3:h:cisco:nexus_1000v:4.2\\(1\\)sv1\\(5.1a\\):-:*:*:*:vmware_vsphere:*:*", "vulnerable": true, "matchCriteriaId": "5A87AEED-3CC1-4D78-9F31-9CF9702351D7"}, {"criteria": "cpe:2.3:h:cisco:nexus_1000v:4.2\\(1\\)sv1\\(5.2\\):-:*:*:*:vmware_vsphere:*:*", "vulnerable": true, "matchCriteriaId": "B59A502A-467B-464B-9B81-46D08B75ED84"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}