SB2017070603 - Multiple vulnerabilities in Cisco Ultra Services Framework

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2017070603

SB2017070603 - Multiple vulnerabilities in Cisco Ultra Services Framework

Published: July 6, 2017

Security Bulletin ID SB2017070603
CSH Severity
High
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 50% Medium 25% Low 25%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) OS command injection (CVE-ID: CVE-2017-6714)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote unauthenticated attacker to execute arbitrary shell commands.

The vulnerability exists in the AutoIT service of Cisco Ultra Services Framework Staging Server due to improper shell invocations. A remote attacker can use specially crafted CLI commands to execute Linux shell commands with root privileges.

Successful exploitation of the vulnerability may result in system compromise.

2) Information disclosure (CVE-ID: CVE-2017-6709)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote unauthenticated attacker to obtain potentially sensitive information.

The vulnerability exists in the AutoVNF tool for the Cisco Ultra Services Framework due to logging of administrative credentials for Cisco ESC and Cisco OpenStack deployment purposes in clear text. A remote attacker can access the AutoVNF URL for the location where the log files are stored and subsequently access the administrative credential.

Successful exploitation of the vulnerability may result in information disclosure.

3) Improper input validation (CVE-ID: CVE-2017-6708)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote unauthenticated attacker to obtain potentially sensitive information or execute arbitrary code.

The vulnerability exists in the symbolic link (symlink) creation functionality of the AutoVNF tool for the Cisco Ultra Services Framework due to improper input validation. A remote attacker can supply specially crafted data used to create symbolic links and read any sensitive file or execute malicious code on an affected system.

Successful exploitation of the vulnerability may result in system compromise.

4) Security restrictions bypass (CVE-ID: CVE-2017-6711)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote unauthenticated attacker to bypass security restrictions.

The vulnerability exists in the Ultra Automation Service (UAS) of the Cisco Ultra Services Framework due to an insecure default configuration of the Apache ZooKeeper service. A remote attacker can use orchestrator network to bypass security restrictions, gain access to ZooKeeper data nodes (znodes) and influence the behavior of the system's high-availability feature.

Successful exploitation of the vulnerability may result in unauthorized access to the affected device.

Remediation

Install update from vendor's website.

References