Sign-up

ID

VAR-201107-0203


CVE

CVE-2011-2760


TITLE

Brocade BigIron RX Switch ACL Security Bypass Vulnerability

Trust: 2.1

sources: CNVD: CNVD-2011-2679 // BID: 48663 // CNNVD: CNNVD-201107-182 // CNNVD: CNNVD-201107-200

DESCRIPTION

Brocade BigIron RX switches allow remote attackers to bypass ACL rules by using 179 as the source port of a packet. Brocade BigIron RX The switch has a port 179 There is a vulnerability in the processing of packets sent from, and there is a vulnerability that bypasses access control list restrictions.Access control list by remote third party (ACL) May be able to circumvent this limitation and allow intrusion of specially crafted packets into the network. The Brocade BigIron RX Series Switch is the first to handle 2.2 billion packets per second. Port 179 is generally used for BGP communication. An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions. ---------------------------------------------------------------------- The Secunia Vulnerability Intelligence Manager (VIM) enables you to handle vulnerability threats in a simple, cost effective way. Read more and request a free trial: http://secunia.com/products/corporate/vim/ ---------------------------------------------------------------------- TITLE: Brocade BigIron RX Switches Access Control List Security Bypass Security Issue SECUNIA ADVISORY ID: SA45217 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/45217/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=45217 RELEASE DATE: 2011-07-14 DISCUSS ADVISORY: http://secunia.com/advisories/45217/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/45217/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=45217 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: A security issue has been reported in Brocade BigIron RX Switches, which can be exploited by malicious people to bypass certain security restrictions. SOLUTION: Restrict access to trusted hosts only. PROVIDED AND/OR DISCOVERED BY: An anonymous person via US-CERT. ORIGINAL ADVISORY: http://www.kb.cert.org/vuls/id/853246 OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 3.33

sources: NVD: CVE-2011-2760 // CERT/CC: VU#853246 // JVNDB: JVNDB-2011-001929 // CNVD: CNVD-2011-2679 // BID: 48663 // VULHUB: VHN-50705 // PACKETSTORM: 103028

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2011-2679

AFFECTED PRODUCTS

vendor:brocademodel:bigiron rx switchscope:eqversion:*

Trust: 1.0

vendor:brocademodel: - scope: - version: -

Trust: 0.8

vendor:brocademodel:bigiron rxscope: - version: -

Trust: 0.8

vendor:brocademodel:bigiron rx switchesscope: - version: -

Trust: 0.6

vendor:brocademodel:bigiron rx switchscope: - version: -

Trust: 0.6

vendor:brocademodel:bigiron rxscope:eqversion:0

Trust: 0.3

sources: CERT/CC: VU#853246 // CNVD: CNVD-2011-2679 // BID: 48663 // JVNDB: JVNDB-2011-001929 // CNNVD: CNNVD-201107-200 // NVD: CVE-2011-2760

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2011-2760
value: MEDIUM

Trust: 1.0

CARNEGIE MELLON: VU#853246
value: 0.28

Trust: 0.8

NVD: CVE-2011-2760
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201107-200
value: MEDIUM

Trust: 0.6

VULHUB: VHN-50705
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2011-2760
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-50705
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: CERT/CC: VU#853246 // VULHUB: VHN-50705 // JVNDB: JVNDB-2011-001929 // CNNVD: CNNVD-201107-200 // NVD: CVE-2011-2760

PROBLEMTYPE DATA

problemtype:CWE-264

Trust: 1.9

sources: VULHUB: VHN-50705 // JVNDB: JVNDB-2011-001929 // NVD: CVE-2011-2760

THREAT TYPE

??

Trust: 0.6

sources: CNNVD: CNNVD-201107-182

TYPE

permissions and access control

Trust: 1.2

sources: CNNVD: CNNVD-201107-182 // CNNVD: CNNVD-201107-200

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2011-001929

PATCH
title:Brocade BigIron RXシリーズ 概要url:http://www.brocadejapan.com/products/switches/bigiron-rx-series/overview
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2011-001929

EXTERNAL IDS
db:CERT/CCid:VU#853246
Trust: 4.3
db:BIDid:48663
Trust: 4.0
db:NVDid:CVE-2011-2760
Trust: 2.8
db:SECUNIAid:45217
Trust: 2.7
db:XFid:68535
Trust: 1.4
db:OSVDBid:73869
Trust: 1.1
db:JVNDBid:JVNDB-2011-001929
Trust: 0.8
db:CNNVDid:CNNVD-201107-200
Trust: 0.7
db:CNVDid:CNVD-2011-2679
Trust: 0.6
db:CNNVDid:CNNVD-201107-182
Trust: 0.6
db:VULHUBid:VHN-50705
Trust: 0.1
db:PACKETSTORMid:103028
Trust: 0.1
sources:
            
            
            CERT/CC: VU#853246 // 
            
            
            
            CNVD: CNVD-2011-2679 // 
            
            
            
            VULHUB: VHN-50705 // 
            
            
            
            BID: 48663 // 
            
            
            
            JVNDB: JVNDB-2011-001929 // 
            
            
            
            PACKETSTORM: 103028 // 
            
            
            
            CNNVD: CNNVD-201107-182 // 
            
            
            
            CNNVD: CNNVD-201107-200 // 
            
            
            
            NVD: CVE-2011-2760

REFERENCES
url:http://www.securityfocus.com/bid/48663
Trust: 3.1
url:http://www.kb.cert.org/vuls/id/853246
Trust: 2.9
url:http://secunia.com/advisories/45217
Trust: 2.5
url:http://xforce.iss.net/xforce/xfdb/68535
Trust: 1.4
url:http://osvdb.org/73869
Trust: 1.1
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/68535
Trust: 1.1
url:about vulnerability notes
Trust: 0.8
url:contact us about this vulnerability
Trust: 0.8
url:provide a vendor statement
Trust: 0.8
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-2760
Trust: 0.8
url:http://jvn.jp/cert/jvnvu853246
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-2760
Trust: 0.8
url:http://www.kb.cert.org/vuls/id/853246http
Trust: 0.6
url:http://www.brocade.com/products/all/switches/product-details/bigiron-rx-series/overview.page
Trust: 0.3
url:https://ca.secunia.com/?page=viewadvisory&vuln_id=45217
Trust: 0.1
url:http://secunia.com/vulnerability_intelligence/
Trust: 0.1
url:http://secunia.com/advisories/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/advisories/45217/#comments
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
Trust: 0.1
url:http://secunia.com/products/corporate/vim/
Trust: 0.1
url:http://secunia.com/advisories/45217/
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/personal/
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:http://secunia.com/advisories/about_secunia_advisories/
Trust: 0.1
sources:
            
            
            CERT/CC: VU#853246 // 
            
            
            
            CNVD: CNVD-2011-2679 // 
            
            
            
            VULHUB: VHN-50705 // 
            
            
            
            BID: 48663 // 
            
            
            
            JVNDB: JVNDB-2011-001929 // 
            
            
            
            PACKETSTORM: 103028 // 
            
            
            
            CNNVD: CNNVD-201107-182 // 
            
            
            
            CNNVD: CNNVD-201107-200 // 
            
            
            
            NVD: CVE-2011-2760

CREDITS
Anonymous
Trust: 0.9
sources:
            
            
            BID: 48663 // 
            
            
            
            CNNVD: CNNVD-201107-182

SOURCES
db:CERT/CCid:VU#853246
db:CNVDid:CNVD-2011-2679
db:VULHUBid:VHN-50705
db:BIDid:48663
db:JVNDBid:JVNDB-2011-001929
db:PACKETSTORMid:103028
db:CNNVDid:CNNVD-201107-182
db:CNNVDid:CNNVD-201107-200
db:NVDid:CVE-2011-2760

LAST UPDATE DATE
2024-08-14T13:58:49.363000+00:00

SOURCES UPDATE DATE
db:CERT/CCid:VU#853246date:2012-02-03T00:00:00
db:CNVDid:CNVD-2011-2679date:2011-07-14T00:00:00
db:VULHUBid:VHN-50705date:2017-08-29T00:00:00
db:BIDid:48663date:2015-04-13T21:01:00
db:JVNDBid:JVNDB-2011-001929date:2011-07-26T00:00:00
db:CNNVDid:CNNVD-201107-182date:2011-07-15T00:00:00
db:CNNVDid:CNNVD-201107-200date:2011-07-18T00:00:00
db:NVDid:CVE-2011-2760date:2017-08-29T01:29:32.973

SOURCES RELEASE DATE
db:CERT/CCid:VU#853246date:2011-07-13T00:00:00
db:CNVDid:CNVD-2011-2679date:2011-07-14T00:00:00
db:VULHUBid:VHN-50705date:2011-07-17T00:00:00
db:BIDid:48663date:2011-07-13T00:00:00
db:JVNDBid:JVNDB-2011-001929date:2011-07-26T00:00:00
db:PACKETSTORMid:103028date:2011-07-13T03:49:36
db:CNNVDid:CNNVD-201107-182date:1900-01-01T00:00:00
db:CNNVDid:CNNVD-201107-200date:2011-07-18T00:00:00
db:NVDid:CVE-2011-2760date:2011-07-17T20:55:02.077