buffer overflow vulnerability in “secpolicydelete” command

Vulnerability

A buffer overflow vulnerability exists in the secpolicydelete command of Brocade Fabric OS. The vulnerability affects versions before Brocade Fabric OS v9.1.1c and v9.2.0, and is present in systems running affected versions [1]. The issue occurs when a privileged user executes the secpolicydelete command with crafted input, leading to a buffer overflow condition [1].

Exploitation

An attacker must have authenticated privileged access to the Brocade Fabric OS switch. The attacker triggers the vulnerability by executing the secpolicydelete command with specially crafted input that causes a buffer overflow [1]. No other user interaction or network position is required beyond having administrative credentials.

Impact

Successful exploitation causes the Brocade Fabric OS switch to crash, resulting in a denial of service (DoS). This impacts the availability of the switch and associated network services [1].

Mitigation

Brocade has released fixes in Brocade Fabric OS v9.1.1c, v9.2.0, and v8.2.3e [1]. Users should upgrade to one of these versions or later. The vulnerability was discovered during internal penetration testing [1].