Local Privilege Escalation in Brocade Fabric OS

Executive Summary

This is a local privilege escalation vulnerability in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. It involves insufficient access controls on IPC channels allowing an unprivileged local user to submit malformed logging configurations. Improper input sanitization during configuration file generation enables attackers to inject arbitrary directives that execute with elevated privileges when the logging service reloads.

Useful 0 Not Useful 0

Impact Analysis

An attacker with local access could exploit this to gain higher privileges on the system, potentially allowing them to execute unauthorized commands, access sensitive data, or perform actions beyond their intended permissions. This could lead to system compromise or further network infiltration.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations using affected Brocade Fabric OS versions may face legal penalties, reputational damage, or loss of certification if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Update Brocade Fabric OS to version 9.2.2d or later, or 10.0.0a2 or later if using version 10.0.0. Avoid using untrusted local users with access to the system logging daemon configuration.

Useful 0 Not Useful 0