Advisory Details

November 10th, 2015

IBM System Networking Switch Center Local Privilege Escalation Vulnerability

ZDI-15-551
ZDI-CAN-3008

CVE ID CVE-2015-7818
CVSS SCORE 7.2, (AV:L/AC:L/Au:N/C:C/I:C/A:C)
AFFECTED VENDORS IBM
AFFECTED PRODUCTS System Networking Switch Center
VULNERABILITY DETAILS


This vulnerability allows local unprivileged attackers to execute arbitrary code on vulnerable installations of IBM System Networking Switch Center. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the IBM SNSC Web Service, which listens by default on ports 40080 (HTTP) or 40443 (HTTPS) for requests to the administration panel. Because this service offers access to the Apache Axis AdminService, an unprivileged local attacker can publish arbitrary classes with the deployment method. An attacker can leverage this access to install arbitrary .jsp files on the server, which will by default run under the context of SYSTEM.

ADDITIONAL DETAILS IBM has issued an update to correct this vulnerability. More details can be found at:
https://support.lenovo.com/us/en/product_security/len_2015_074
DISCLOSURE TIMELINE
  • 2015-06-23 - Vulnerability reported to vendor
  • 2015-11-10 - Coordinated public release of advisory
CREDIT rgod
BACK TO ADVISORIES