Executive Summary
Summary | |
---|---|
Title | Cisco Cloud Services Platform 2100 Command Injection Vulnerability |
Informations | |||
---|---|---|---|
Name | cisco-sa-20160921-csp2100-1 | First vendor Publication | 2016-09-21 |
Vendor | Cisco | Last vendor Modification | 2016-09-21 |
Severity (Vendor) | N/A | Revision | 1.0 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:L/Au:S/C:C/I:C/A:C) | |||
---|---|---|---|
Cvss Base Score | 9 | Attack Range | Network |
Cvss Impact Score | 10 | Attack Complexity | Low |
Cvss Expoit Score | 8 | Authentication | Requires single instance |
Calculate full CVSS 2.0 Vectors scores |
Detail
A vulnerability in the web-based GUI of the Cisco Cloud Services Platform 2100 could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system with the privileges of the root user. The vulnerability is due to insufficient sanitization of user-supplied input. An attacker could exploit this vulnerability by authenticating to the affected system with administrative privileges and inserting arbitrary commands. An exploit could allow the attacker to execute arbitrary commands on the host operating system with the privileges of root. Cisco has released software updates that address this vulnerability. Workarounds that address this vulnerability are not available. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160921-csp2100-1 BEGIN PGP SIGNATURE Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJX4qcEAAoJEK89gD3EAJB5pnQP/RkhC3wsUC1bPwmPjleqpSck d8GvNrfAw+3GgMkMj0WFoHKvszo2/Cm6Ao1mIz+Rc/D+g2uZOQmmnuxXflc4Trip Vx+jjSwH02j3q55sj8bGDrSezmpHLEshKn85Z2wBYFRqydxkXwUXHiFpLJ7KKv1n 8ASMBScusjxc63KrleLFpUy4vdVtnvVSqlnwVrb36DrPnBQ2r2UpVGtQAvkaUU4h V8wOfi+kR7bTXYPkBV480BKaTWA/W9XJVxlYPYhuo+KY049E5osk68rEeXYWpC1H k41aT3iaLcdz/0m7tm/ycBjci/97bAbwiG4Kl4zOXa429iK5R4/sqgLsh1TyoQ71 OmjxZj6LvR3E3R+lONm8Htv80W8VGWRpeNTr9hPFC+mtHTx1dAl821oJC7xs8Q/W 46isqjdYUohUa+aN/ZJyYJeUfC2DRHE4X6KtPR/fry7sWgFzPWzVKZU4tEjlTDPT 8LfNgXb6pegRyLZmgd73lv0ngGRwZBFVuXqL9kNFPgXf7X3PTihUWcgQ/yFuXgDo wVQmLEYzzxnt7/T2TVgLZ8c5jm70kFjWHWxwumVYliEnfXYWuOKHE2hPXuk9T9W8 RxD2ZBKI/gZtOimzLFdQIqvbqJ1V6gbo5aZDQGWgdLwfdMaIefhAdUfCSCqQwrHe SKPu1igJkamlZfkkl26P =SK2h END PGP SIGNATURE _______________________________________________ cust-security-announce mailing list cust-security-announce@cisco.com To unsubscribe, send the command "unsubscribe" in the subject of your message to cust-security-announce-leave@cisco.com |
Original Source
Url : http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco (...) |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-78 | Improper Sanitization of Special Elements used in an OS Command ('OS Command Injection') (CWE/SANS Top 25) |
CPE : Common Platform Enumeration
Type | Description | Count |
---|---|---|
Application | 1 |
Snort® IPS/IDS
Date | Description |
---|---|
2016-09-22 | Cisco Cloud Services Platform dnslookup command injection attempt RuleID : 40257 - Revision : 1 - Type : SERVER-WEBAPP |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2016-10-13 | Name : The remote network virtual services management device is affected by multiple... File : cisco-sa-20160921-csp2100.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2016-10-14 13:25:02 |
|
2016-09-23 21:26:32 |
|
2016-09-23 05:24:01 |
|
2016-09-21 21:28:59 |
|