Extreme Networks ExtremeWare XOS Privilege Escalation Vulnerability

Bugtraq ID:	13690
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	May 19 2005 12:00AM
Updated:	May 19 2005 12:00AM
Credit:	The vendor announced this issue.
Vulnerable:	Extremenetworks ExtremeWare XOS 11.1 Extremenetworks ExtremeWare XOS 11.0 Extremenetworks ExtremeWare XOS 10.0 Extremenetworks BlackDiamond 8800 0 Extremenetworks BlackDiamond 10808
Not Vulnerable:

Extreme Networks ExtremeWare XOS Privilege Escalation Vulnerability

Extreme Networks ExtremeWare XOS is prone to a local privilege escalation vulnerability.

The exact details of the vulnerability are not available. However, reports indicate that the issue may be leveraged by an authenticated attacker to gain superuser shell access to the underlying XOS operating system.

This issue is reported to affect ExtremeWare XOS 11.1: all versions prior to version 11.1.3.3, 11.0: all versions prior to 11.0.2.4, and 10.x: all versions.

Extreme Networks ExtremeWare XOS Privilege Escalation Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Extreme Networks ExtremeWare XOS Privilege Escalation Vulnerability

Solution:
The vendor has released an advisory and fixes to address this issue. Please see the referenced advisory (In references section of this BID) for further details in regard to obtaining and applying an appropriate update.

Extreme Networks ExtremeWare XOS Privilege Escalation Vulnerability

References:

• Extreme Networks Security Alert on ExtremeWare® XOS? Based Systems (Extreme Networks)
  
• Vendor Home Page (Extreme Networks)
  
• Vulnerability Note VU#937838 - Extreme Networks switches with ExtremeWare XOS al (US-CERT)