cisco-sa-20190501-apic-priv-escalation: Cisco Application Policy Infrastructure Controller Privilege Escalation Vulnerability
First published: Wed May 01 2019(Updated: )
A vulnerability in the FUSE filesystem functionality for Cisco Application Policy Infrastructure Controller (APIC) software could allow an authenticated, local attacker to escalate privileges to root on an affected device. The vulnerability is due to insufficient input validation for certain command strings issued on the CLI of the affected device. An attacker with write permissions for files within a readable folder on the device could alter certain definitions in the affected file. A successful exploit could allow an attacker to cause the underlying FUSE driver to execute said crafted commands, elevating the attacker's privileges to root on an affected device. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-apic-priv-escalation
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Application Policy Infrastructure Controller (APIC) |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of cisco-sa-20190501-apic-priv-escalation?
The severity of cisco-sa-20190501-apic-priv-escalation is considered critical due to its potential for unauthorized root privilege escalation.
How do I fix cisco-sa-20190501-apic-priv-escalation?
To fix cisco-sa-20190501-apic-priv-escalation, update to the latest version of Cisco Application Policy Infrastructure Controller that includes the relevant security patches.
Who is affected by cisco-sa-20190501-apic-priv-escalation?
Cisco Application Policy Infrastructure Controller (APIC) users with insufficient input validation in the FUSE filesystem functionality are affected by cisco-sa-20190501-apic-priv-escalation.
What type of vulnerability is cisco-sa-20190501-apic-priv-escalation?
cisco-sa-20190501-apic-priv-escalation is a privilege escalation vulnerability that allows local attackers to gain root access.
Can cisco-sa-20190501-apic-priv-escalation be exploited remotely?
No, cisco-sa-20190501-apic-priv-escalation requires local authentication, meaning an attacker must have local access to the affected device to exploit the vulnerability.
- agent/type
- agent/event
- agent/last-modified-date
- agent/first-publish-date
- collector/cisco-advisory
- source/Cisco
- agent/references
- agent/weakness
- agent/severity
- agent/title
- agent/description
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco application policy infrastructure controller (apic)