CVE-2014-4870

2014-10-0710:55:04

CWE-20

[email protected]

web.nvd.nist.gov

cve-2014-4870

brocade vyatta

vrouter

privilege escalation

nvd

7.2 High

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

6.8 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

0.4%

JSON

/opt/vyatta/bin/sudo-users/vyatta-clear-dhcp-lease.pl on the Brocade Vyatta 5400 vRouter 6.4R(x), 6.6R(x), and 6.7R1 does not properly validate parameters, which allows local users to gain privileges by leveraging the sudo configuration.

Affected configurations

NVD

Node

brocadevyatta_5400_vrouter_softwareMatch6.4

brocadevyatta_5400_vrouter_softwareMatch6.6

brocadevyatta_5400_vrouter_softwareMatch6.7

AND

brocadevyatta_5400_vrouterMatch-

CPENameOperatorVersion
brocade:vyatta_5400_vrouter_softwarebrocade vyatta 5400 vrouter softwareeq6.4
brocade:vyatta_5400_vrouter_softwarebrocade vyatta 5400 vrouter softwareeq6.6
brocade:vyatta_5400_vrouter_softwarebrocade vyatta 5400 vrouter softwareeq6.7
brocade:vyatta_5400_vrouterbrocade vyatta 5400 vroutereq-

CPE	Name	Operator	Version
brocade:vyatta_5400_vrouter_software	brocade vyatta 5400 vrouter software	eq	6.4
brocade:vyatta_5400_vrouter_software	brocade vyatta 5400 vrouter software	eq	6.6
brocade:vyatta_5400_vrouter_software	brocade vyatta 5400 vrouter software	eq	6.7
brocade:vyatta_5400_vrouter	brocade vyatta 5400 vrouter	eq	-