Executive Summary
Summary | |
---|---|
Title | Cisco Ultra Services Framework AutoVNF Log File User Credential Information Disclosure Vulnerability |
Informations | |||
---|---|---|---|
Name | cisco-sa-20170705-usf2 | First vendor Publication | 2017-07-05 |
Vendor | Cisco | Last vendor Modification | 2017-07-05 |
Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:L/Au:N/C:P/I:N/A:N) | |||
---|---|---|---|
Cvss Base Score | 5 | Attack Range | Network |
Cvss Impact Score | 2.9 | Attack Complexity | Low |
Cvss Expoit Score | 10 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
A vulnerability in the AutoVNF tool for the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to access administrative credentials for Cisco Elastic Services Controller (ESC) and Cisco OpenStack deployments in an affected system. The vulnerability exists because the affected software logs administrative credentials in clear text for Cisco ESC and Cisco OpenStack deployment purposes. An attacker could exploit this vulnerability by accessing the AutoVNF URL for the location where the log files are stored and subsequently accessing the administrative credentials that are stored in clear text in those log files. A successful exploit could allow the attacker to access the administrative credentials for Cisco ESC and Cisco OpenStack deployments in the affected system, which the attacker could use to conduct additional attacks. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170705-usf2 ["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170705-usf2"] BEGIN PGP SIGNATURE iQKBBAEBAgBrBQJZXQ8BZBxDaXNjbyBTeXN0ZW1zIFByb2R1Y3QgU2VjdXJpdHkg SW5jaWRlbnQgUmVzcG9uc2UgVGVhbSAoQ2lzY28gUFNJUlQga2V5IDIwMTYtMjAx NykgPHBzaXJ0QGNpc2NvLmNvbT4ACgkQrz2APcQAkHmZXRAAgTMMRlPMG4/lh1al jE+VEXZx+oCd4aFkYRD3s7/m69DGYZ08QjtlAa5Ocl3I96havrUOqTfpj8sxXvBJ GE/XzhQCnsoR7EySd0FbIdLGNQtgfmPaDLJpJTDQN98R29C9PVi3E9voWXudubkd 5msIPeEdr4c5CZWKE8mejPsaX/ormA1sBjx/JxaO9WWAwfBuKJGObNx2fX8QTN1c ynFj5NWjr7uMHARMoHdPu4W4b9ltEVOWV3jhKr+oxFkGGwUcye71YTF+hDtPLxRN kW8N9NpPLR+WzZTa8FuAy9JTJPpxyvElPPYVsq0znuZSSzjQtMHsQ2QtZi4RxV4e jUz5pqkOlqTVC5VX8OvwZ30K2rMcR8WkEM3EUiXMGMNVIRJ8twCZ7ThXb3LGjEDQ viyEWoUOb8lnqnkwpq6sxJzQAvm3yvwWSBlB6XZ7WoeyYpUnKVVm0RQlGKF9UFk/ u5OI24L6Yhl2yuVMMx9Tp+ctsLmD8lQIj0dEtlAlg3+vba50DHX1Dg7skQ4ZAWPx KXhBhqJnxZ7etDpCVsyDnvk9JPOccXbPbGza5PLqfHYTvttzXA+CZrkFArc51jjf G9eifsB0uwZr4Jx4iTsNuh1fY1z+2mzHB3JAnLPPB8Kj3W6VXyATIgI5ucAs/SAj YHwq7LFhCA0+/5TdbZdno6zh0lo= =64fQ END PGP SIGNATURE _______________________________________________ cust-security-announce mailing list cust-security-announce@cisco.com To unsubscribe, send the command "unsubscribe" in the subject of your message to cust-security-announce-leave@cisco.com |
Original Source
Url : http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco (...) |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
50 % | CWE-532 | Information Leak Through Log Files |
50 % | CWE-522 | Insufficiently Protected Credentials (CWE/SANS Top 25) |
Snort® IPS/IDS
Date | Description |
---|---|
2017-07-06 | log file access detected RuleID : 43449 - Revision : 1 - Type : POLICY-OTHER |
Alert History
Date | Informations |
---|---|
2017-07-07 21:24:49 |
|
2017-07-06 09:24:47 |
|
2017-07-06 00:22:08 |
|