Executive Summary
Summary | |
---|---|
Title | Cisco Prime Infrastructure and Evolved Programmable Network Manager Remote Code Execution Vulnerability |
Informations | |||
---|---|---|---|
Name | cisco-sa-20160406-remcode | First vendor Publication | 2016-04-06 |
Vendor | Cisco | Last vendor Modification | 2016-04-06 |
Severity (Vendor) | N/A | Revision | 1.0 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C) | |||
---|---|---|---|
Cvss Base Score | 9.3 | Attack Range | Network |
Cvss Impact Score | 10 | Attack Complexity | Medium |
Cvss Expoit Score | 8.6 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
A vulnerability in the web interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow an unauthenticated, remote attacker to execute arbitrary code on a targeted system. The vulnerability is due to insufficient sanitization of HTTP user-supplied input. An attacker could exploit this vulnerability by sending an HTTP POST with crafted deserialized user data. An exploit could allow the attacker to execute arbitrary code with root-level privileges on the affected system, which could be used to conduct further attacks. Cisco has released software updates that address this vulnerability. Workarounds are not available. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160406-remcode BEGIN PGP SIGNATURE Version: GnuPG v1.4.5 (SunOS) iQIVAwUBVvwW1q89gD3EAJB5AQLU4BAAyVleGTpbOO2B2/XM1NBCcB5qJ5K/DrSd hmyLpLBt7AvVywWTT44ofYUusDvz4tuAYOKq0GXrF8mvJyEP0L8xTZgKzusMb1p/ WxXl9PiyX72NVdJGT3MArrJrq+rMOBVzArU3ytAkXpVWAEU02XRwEkrZtYRGW0aV y32fCOl6kNQTwB8eIX9ncZZ1tsRbpQfEpYoBPuRJ3JYqNb6r32YTbXRsiJV5RWTI cxDP685HlM+07tx9VkGha3K0jDZUMWAJNmMl9mmYIClU4rVnwJa+d5vupCYJM4b5 7C270KA+5gkaJ0eadoR6Cws0wJ3661x5xodL9NR9E8h7je4d1aI1R0pdI8slaLIL 2doba85zsMZskjrxd12Ge4oTwYvCfC9CthhRKtCp+MNeJXyBIoDBFEbHMTmD7zTq EKK38udpIYR8+XEetWhLhDdVX5bw/fvWDjb/CVe5bTJ9JihAZgAJ+l9tjnK10+lV M0AqJ6kTG0SBlUKAxZ9gy3STcg5P8Ttil4FV80WsclGCAiNl6myUIzCvo0OhERUC gVuJEl2VODOADi7iqXV2vLpyz5cwgGgjEJ+2oUMHn6jycBzaUqzknbe+hYPC5pn +NXWTakXyo/8kGrkK5SbU3IsZAWIiOs9GBS1X4GWfsTbrtl6tUxjX9Nix91xNp3zu 4h9eGOzLkus= =z8pz END PGP SIGNATURE _______________________________________________ cust-security-announce mailing list cust-security-announce@cisco.com To unsubscribe, send the command "unsubscribe" in the subject of your message to cust-security-announce-leave@cisco.com |
Original Source
Url : http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco (...) |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-20 | Improper Input Validation |
CPE : Common Platform Enumeration
Snort® IPS/IDS
Date | Description |
---|---|
2016-03-29 | Java Library CommonsCollection unauthorized serialized object attempt RuleID : 37859 - Revision : 6 - Type : SERVER-WEBAPP |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2016-04-19 | Name : The remote Cisco Prime Infrastructure application running on the remote host ... File : cisco_prime_infrastructure_20161291.nasl - Type : ACT_ATTACK |
Alert History
Date | Informations |
---|---|
2016-04-20 13:28:17 |
|
2016-04-08 00:27:25 |
|
2016-04-06 21:24:35 |
|