Executive Summary
| Summary | |
|---|---|
| Title | Cisco Application-Hosting Framework Arbitrary File Creation Vulnerability |
| Informations | |||
|---|---|---|---|
| Name | cisco-sa-20170322-caf2 | First vendor Publication | 2017-03-22 |
| Vendor | Cisco | Last vendor Modification | 2017-03-22 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:S/C:N/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 5.5 | Attack Range | Network |
| Cvss Impact Score | 4.9 | Attack Complexity | Low |
| Cvss Expoit Score | 8 | Authentication | Requires single instance |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| A vulnerability in the Cisco application-hosting framework (CAF) component of the Cisco IOx application environment could allow an authenticated, remote attacker to write or modify arbitrary files in the virtual instance running on the affected device. The vulnerability is due to insufficient input validation of user-supplied application packages. An attacker who can upload a malicious package within Cisco IOx could exploit the vulnerability to modify arbitrary files. The impacts of a successful exploit are limited to the scope of the virtual instance and do not impact the router that is hosting Cisco IOx. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170322-caf2 ["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170322-caf2"] BEGIN PGP SIGNATURE iQKBBAEBAgBrBQJY0qMVZBxDaXNjbyBTeXN0ZW1zIFByb2R1Y3QgU2VjdXJpdHkg SW5jaWRlbnQgUmVzcG9uc2UgVGVhbSAoQ2lzY28gUFNJUlQga2V5IDIwMTYtMjAx NykgPHBzaXJ0QGNpc2NvLmNvbT4ACgkQrz2APcQAkHkNGBAAjNLFdOzumuxD/0ls +4wX3o9KQ2DwDtkG0uy+2H/6xt6DH8cUx/K5wPmd43fZ3aqBesuHWHa9ARtaKvzH BI39aZPWppzWwuw9ackMFzKHUbjaqry2tNAZhRrB7zlIBNW8cP3JI9Go0Y4k82vc X5oWsCqEGhzqkdXbFIIvOEkyLhti6sGPzFzJdiv3v4eegPaAeS5IqoiucV+mkpXV qPrs1A9wMkR/sZ1st+seQc0v9XF6IuEUbbEamtNBLwxMQdeKHBnUCqFcr7o1TLVI WlMAiH0/+wxSwFxWo+fhNSJJKRqyou6JJ7RFkqNyllfjA1yi1c/hzalv9HL9gb8f cpbq2rWrZjV/sFZB+xHZHGcdZGitqzNy8CVbxyiagz9BVf79j0g0TaVoAO9IvJFI O6I1hGDY1kbhqS30+ufOMNv3CAc56cmTE2a+6nlUdsTsYleEzbHk4jQUQqpMcGLO dVajwC00F/9lkWUDhMV+Fv7axwDqFEkDK4R0+EuSjI9w+wtTp4k4SrlAqMZOZjCc X78sbuP6xtZWWGgu/U2Z10n37qBo4Pv0Mu93ZAgy+prNu9C8acOOafubzzh25nOC B4I1W0KnWkJggfR5gp9fpBOKOvqo0WaItu5r8p0RX6iw0mC6A+snIP5lZKoq577s RBf/NXB5gghGmYog5Cq6qnYFVvc= =rzMN END PGP SIGNATURE _______________________________________________ cust-security-announce mailing list cust-security-announce@cisco.com To unsubscribe, send the command "unsubscribe" in the subject of your message to cust-security-announce-leave@cisco.com |
Original Source
| Url : http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco (...) |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-20 | Improper Input Validation |
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 2 |
Alert History
| Date | Informations |
|---|---|
| 2017-03-28 00:25:03 |
|
| 2017-03-23 00:25:04 |
|
| 2017-03-22 21:22:59 |
|
