Man-in-the-middle attack in Context Service - CVE-2017-6667
Published: June 12, 2017 / Updated: June 12, 2017
Vulnerability identifier: #VU7009
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-6667
CWE-ID: CWE-300
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote unauthenticated attacker to execute arbitrary code on the target system.
The weakness exists in the Cisco Context Service software development kit (SDK) due to insufficient validation of the update JAR file's signature. A remote attacker can conduct man-in-the-middle attack during the update process, gain control over trusted signing certificate, replace the original JAR file with an altered version and execute arbitrary code with the privileges of the web server.
Successful exploitation of the vulnerability may result in system compromise.
The weakness exists in the Cisco Context Service software development kit (SDK) due to insufficient validation of the update JAR file's signature. A remote attacker can conduct man-in-the-middle attack during the update process, gain control over trusted signing certificate, replace the original JAR file with an altered version and execute arbitrary code with the privileges of the web server.
Successful exploitation of the vulnerability may result in system compromise.
Affected software
Context Service
How to mitigate CVE-2017-6667
Install update from vendor's website.