CVE-2015-6335

Vulnerability

The policy implementation in Cisco FireSIGHT Management Center for VMware versions 5.3.1.7, 5.4.0.4, and 6.0.0 contains a vulnerability due to insufficient sanitization of user-supplied input. This allows authenticated remote administrators to bypass intended policy restrictions and execute commands on the underlying Linux operating system [1].

Exploitation

An attacker must have valid administrator-level credentials and network access to the FireSIGHT Management Center appliance. By crafting malicious input, the attacker can bypass policy restrictions and execute arbitrary commands on the underlying Linux operating system [1].

Impact

Successful exploitation grants the attacker root-level access to the underlying Linux operating system, resulting in full compromise of the appliance's confidentiality, integrity, and availability [1].

Mitigation

Cisco has released software updates that address this vulnerability. No workarounds are available. Users are advised to upgrade to a fixed version as indicated in the Cisco Security Advisory [1].