A vulnerability, which was classified as critical, was found in Brocade Vyatta 5400 Vrouter Software 6.7 (Router Operating System). This affects an unknown code of the component Privileges. The manipulation with an unknown input leads to a input validation vulnerability. CWE is classifying the issue as CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

/opt/vyatta/bin/sudo-users/vyatta-clear-dhcp-lease.pl on the Brocade Vyatta 5400 vRouter 6.4R(x), 6.6R(x), and 6.7R1 does not properly validate parameters, which allows local users to gain privileges by leveraging the sudo configuration.

The weakness was shared 10/07/2014 as confirmed advisory (CERT.org). It is possible to read the advisory at kb.cert.org. This vulnerability is uniquely identified as CVE-2014-4870 since 07/10/2014. The exploitability is told to be easy. Attacking locally is a requirement. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-71858 and VDB-71857 are related to this item.

Productinfo

Type

• Router Operating System

Vendor

• Brocade

Name

• Vyatta 5400 Vrouter Software

Version

• 6.7

License

• commercial

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion