SB2017061202 - Remote code execution in Cisco Context Service



SB2017061202 - Remote code execution in Cisco Context Service

Published: June 12, 2017

Security Bulletin ID SB2017061202
Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Man-in-the-middle attack (CVE-ID: CVE-2017-6667)

The vulnerability allows a remote unauthenticated attacker to execute arbitrary code on the target system.

The weakness exists in the Cisco Context Service software development kit (SDK) due to insufficient validation of the update JAR file's signature. A remote attacker can conduct man-in-the-middle attack during the update process, gain control over trusted signing certificate, replace the original JAR file with an altered version and execute arbitrary code with the privileges of the web server.

Successful exploitation of the vulnerability may result in system compromise.

Remediation

Install update from vendor's website.