Sign-up

ID

VAR-202104-0379


CVE

CVE-2021-1256


TITLE

Pillow Buffer error vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-202104-975

DESCRIPTION

A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to overwrite files on the file system of an affected device by using directory traversal techniques. A successful exploit could cause system instability if important system files are overwritten. This vulnerability is due to insufficient validation of user input for the file path in a specific CLI command. An attacker could exploit this vulnerability by logging in to a targeted device and issuing a specific CLI command with crafted user input. A successful exploit could allow the attacker to overwrite arbitrary files on the file system of the affected device. The attacker would need valid user credentials on the device. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements. Cisco Firepower System is a next-generation firewall product (NGFW) of Cisco (Cisco)

Trust: 1.62

sources: NVD: CVE-2021-1256 // CNNVD: CNNVD-202104-975 // VULHUB: VHN-374310 // VULMON: CVE-2021-1256

AFFECTED PRODUCTS

vendor:ciscomodel:firepower threat defensescope:lteversion:6.4.0

Trust: 1.0

vendor:ciscomodel:firepower threat defensescope:gteversion:6.6.0

Trust: 1.0

vendor:ciscomodel:firepower threat defensescope:ltversion:6.6.4

Trust: 1.0

sources: NVD: CVE-2021-1256

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-1256
value: MEDIUM

Trust: 1.0

ykramarz@cisco.com: CVE-2021-1256
value: MEDIUM

Trust: 1.0

CNNVD: CNNVD-202104-975
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202104-2090
value: MEDIUM

Trust: 0.6

VULHUB: VHN-374310
value: LOW

Trust: 0.1

VULMON: CVE-2021-1256
value: LOW

Trust: 0.1

nvd@nist.gov: CVE-2021-1256
severity: LOW
baseScore: 3.6
vectorString: AV:L/AC:L/AU:N/C:N/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

VULHUB: VHN-374310
severity: LOW
baseScore: 3.6
vectorString: AV:L/AC:L/AU:N/C:N/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2021-1256
baseSeverity: MEDIUM
baseScore: 6.0
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 0.8
impactScore: 5.2
version: 3.1

Trust: 2.0

sources: VULHUB: VHN-374310 // VULMON: CVE-2021-1256 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202104-2090 // NVD: CVE-2021-1256 // NVD: CVE-2021-1256

PROBLEMTYPE DATA

problemtype:CWE-552

Trust: 1.1

problemtype:CWE-22

Trust: 1.0

sources: VULHUB: VHN-374310 // NVD: CVE-2021-1256

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202104-2090

TYPE

other

Trust: 1.2

sources: CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202104-2090

PATCH

title:Cisco Firepower Threat Defense Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=149518

Trust: 0.6

title:Cisco: Cisco Firepower Threat Defense Software Command File Overwrite Vulnerabilityurl:https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-ftd-file-overwrite-XknRjGdB

Trust: 0.1

sources: VULMON: CVE-2021-1256 // CNNVD: CNNVD-202104-2090

EXTERNAL IDS

db:NVDid:CVE-2021-1256

Trust: 1.8

db:MCAFEEid:SB10382

Trust: 1.7

db:CNNVDid:CNNVD-202104-2090

Trust: 0.7

db:CS-HELPid:SB2021041363

Trust: 0.6

db:CNNVDid:CNNVD-202104-975

Trust: 0.6

db:CS-HELPid:SB2021042909

Trust: 0.6

db:AUSCERTid:ESB-2021.1472

Trust: 0.6

db:AUSCERTid:ESB-2022.1645

Trust: 0.6

db:VULHUBid:VHN-374310

Trust: 0.1

db:VULMONid:CVE-2021-1256

Trust: 0.1

sources: VULHUB: VHN-374310 // VULMON: CVE-2021-1256 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202104-2090 // NVD: CVE-2021-1256

REFERENCES

url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-ftd-file-overwrite-xknrjgdb

Trust: 2.5

url:https://kc.mcafee.com/corporate/index?page=content&id=sb10382

Trust: 1.6

url:https://www.cybersecurity-help.cz/vdb/sb2021041363

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.1472

Trust: 0.6

url:https://nvd.nist.gov/vuln/detail/cve-2021-1256

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021042909

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.1645

Trust: 0.6

url:https://kc.mcafee.com/corporate/index?page=content&id=sb10382

Trust: 0.1

url:https://cwe.mitre.org/data/definitions/552.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: VULHUB: VHN-374310 // VULMON: CVE-2021-1256 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202104-2090 // NVD: CVE-2021-1256

SOURCES

db:VULHUBid:VHN-374310
db:VULMONid:CVE-2021-1256
db:CNNVDid:CNNVD-202104-975
db:CNNVDid:CNNVD-202104-2090
db:NVDid:CVE-2021-1256

LAST UPDATE DATE

2024-08-14T13:08:32.653000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-374310date:2022-07-29T00:00:00
db:VULMONid:CVE-2021-1256date:2021-05-09T00:00:00
db:CNNVDid:CNNVD-202104-975date:2021-04-14T00:00:00
db:CNNVDid:CNNVD-202104-2090date:2022-08-10T00:00:00
db:NVDid:CVE-2021-1256date:2023-11-07T03:27:48.780

SOURCES RELEASE DATE

db:VULHUBid:VHN-374310date:2021-04-29T00:00:00
db:VULMONid:CVE-2021-1256date:2021-04-29T00:00:00
db:CNNVDid:CNNVD-202104-975date:2021-04-13T00:00:00
db:CNNVDid:CNNVD-202104-2090date:2021-04-28T00:00:00
db:NVDid:CVE-2021-1256date:2021-04-29T18:15:08.840