Search criteria
69 vulnerabilities found for Small Business by Cisco
VAR-201111-0147
Vulnerability from variot - Updated: 2024-02-13 22:57Cross-site request forgery (CSRF) vulnerability in the Services Ready Platform Configuration Utility web interface on the Cisco Small Business SRP521W, SRP526W, and SRP527W with firmware before 1.1.24 and the Small Business SRP541W, SRP546W, and SRP547W with firmware before 1.2.1 allows remote attackers to hijack the authentication of administrators for requests that execute arbitrary commands, aka Bug ID CSCtr45124. The problem is ID CSCtr45124 It is a problem.A third party may be able to hijack the administrator's authentication requesting the execution of arbitrary commands. Cisco Small Business SRP500 Series Appliances are prone to a remote command-injection vulnerability. Successful exploits will result in the execution of arbitrary attacker-supplied commands in the context of the root user. This may facilitate a complete compromise. This issue is being tracked by Cisco bug ID CSCtr45124. ----------------------------------------------------------------------
Ovum says ad hoc tools are out-dated. The best practice approach? Fast vulnerability intelligence, threat handling, and setup in one tool.
Read the new report on the Secunia VIM: http://secunia.com/products/corporate/vim/ovum_2011_request/
TITLE: Cisco Small Business SRP520 / SRP540 Series Command Injection Vulnerability
SECUNIA ADVISORY ID: SA46664
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/46664/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=46664
RELEASE DATE: 2011-11-03
DISCUSS ADVISORY: http://secunia.com/advisories/46664/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/46664/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=46664
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: A vulnerability has been reported in Cisco Small Business SRP520 / SRP540 series, which can be exploited by malicious people to compromise a vulnerable system. by tricking a logged-in administrator into following a malicious link. * Cisco SRP526W versions prior to 1.1.24. * Cisco SRP527W versions prior to 1.1.24. * Cisco SRP541W versions prior to 1.2.1. * Cisco SRP546W versions prior to 1.2.1. * Cisco SRP547W versions prior to 1.2.1.
SOLUTION: Update to version 1.1.24 or 1.2.1.
PROVIDED AND/OR DISCOVERED BY: The vendor credits Michal Sajdak, Securitum.
ORIGINAL ADVISORY: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20111102-srp500
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
Cisco Security Advisory: Cisco Small Business SRP500 Series Command Injection Vulnerability
Advisory ID: cisco-sa-20111102-srp500
Revision 1.0
For Public Release 2011 November 2 16:00 UTC (GMT)
+--------------------------------------------------------------------
Summary
Cisco Small Business SRP500 Series Services Ready Platforms contain an operating system command injection vulnerability.
Cisco has released free software updates that address this vulnerability.
Workarounds that mitigate this vulnerability are available.
This advisory is posted at http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20111102-srp500.
Affected Products
Vulnerable Products +------------------
The following Cisco Small Business SRP520 Series models are affected if running firmware prior to version 1.1.24:
- Cisco SRP521W
- Cisco SRP526W
- Cisco SRP527W
The following Cisco Small Business SRP540 Series models are affected if running firmware prior to version 1.2.1:
- Cisco SRP541W
- Cisco SRP546W
- Cisco SRP547W
To view the firmware version on a device, log in to the Services Ready Platform Configuration Utility and navigate to the "Status > Router" page to view information about the SRP and its firmware status. The "Firmware Version" field indicates the current running version of firmware on the SRP500 Series device.
Products Confirmed Not Vulnerable +--------------------------------
No other Cisco products are currently known to be affected by this vulnerability.
Details
Cisco Small Business SRP500 Series Services Ready Platforms are flexible, cost-effective, fixed-configuration customer premises equipment (CPE) with embedded intelligence to enable service providers to create, provision, and deploy premium revenue-generating services -- a variety of high-quality IP voice, data, security, and wireless services -- to small businesses on an as-needed basis.
For this vulnerability to be exploited, a remote attacker must either entice an administrator to access a crafted link or perform a man-in-the-middle attack, intercepting an authenticated session.
Vulnerability Scoring Details
Cisco has provided scores for the vulnerability in this advisory based on the Common Vulnerability Scoring System (CVSS). The CVSS scoring in this Security Advisory is done in accordance with CVSS version 2.0.
CVSS is a standards-based scoring method that conveys vulnerability severity and helps determine urgency and priority of response.
Cisco has provided a base and temporal score. Customers can then compute environmental scores to assist in determining the impact of the vulnerability in individual networks.
Cisco has provided an FAQ to answer additional questions regarding CVSS at:
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to help compute the environmental impact for individual networks at:
http://intellishield.cisco.com/security/alertmanager/cvss
- CSCtr45124 ("Cisco Small Business SRP500 Series Services Ready Platforms Command Injection Vulnerability")
CVSS Base Score - 9.3 Access Vector - Network Access Complexity - Medium Authentication - None Confidentiality Impact - Complete Integrity Impact - Complete Availability Impact - Complete
CVSS Temporal Score - 7.7 Exploitability - Functional Remediation Level - Official-Fix Report Confidence - Confirmed
Impact
Successful exploitation of the vulnerability may result in the execution of arbitrary commands on the device.
Software Versions and Fixes
When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Small Business Support Center or your contracted maintenance provider for assistance.
This vulnerability has been fixed in the following firmware versions:
+------------------------------------------------------------+ | Affected Product | First Fixed Release | |--------------------------+---------------------------------| | Cisco SRP521W | 1.1.24 | |--------------------------+---------------------------------| | Cisco SRP526W | 1.1.24 | |--------------------------+---------------------------------| | Cisco SRP527W | 1.1.24 | |--------------------------+---------------------------------| | Cisco SRP541W | 1.2.1 | |--------------------------+---------------------------------| | Cisco SRP546W | 1.2.1 | |--------------------------+---------------------------------| | Cisco SRP547W | 1.2.1 | +------------------------------------------------------------+
The latest Cisco Small Business SRP500 Series Services Ready Platforms firmware can be downloaded at http://www.cisco.com/cisco/software/navigator.html?mdfid=282736194&i=rm
Workarounds
The following mitigations help limit exposure to this vulnerability.
-
Disable Remote Management
Caution: Do not disable remote management if administrators manage devices via the WAN connection. This action will result in a loss of management connectivity to the device.
Remote Management is enabled by default. Administrators can disable this feature by choosing "Administration > Web Access Management". Change the setting for the Remote Management field to Disabled.
Disabling remote management limits exposure because the vulnerability can then be exploited from the inter-LAN network only.
-
Limit Remote Management Access to Specific IP Addresses
If remote management is required, secure the device so that it can be accessed by certain IP addresses only, rather than the default setting of All IP Addresses. After choosing "Administration > Web Access Management", an administrator can change the Allowed Remote IP Address setting to ensure that only devices with specified IP addresses can access the device.
Obtaining Fixed Software
Cisco has released free software updates that address this vulnerability. Prior to deploying software, customers should consult their maintenance provider or check the software for feature set compatibility and known issues specific to their environment.
Customers may only install and expect support for the feature sets they have purchased. By installing, downloading, accessing or otherwise using such software upgrades, customers agree to be bound by the terms of Cisco's software license terms found at http://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html, or as otherwise set forth at Cisco.com Downloads at http://www.cisco.com/public/sw-center/sw-usingswc.shtml.
Do not contact psirt@cisco.com or security-alert@cisco.com for software upgrades.
Customers should obtain upgraded software through their regular update channels. For most customers, this means that upgrades should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com.
If the information is not clear, please contact the Cisco Small Business Support Center or your contracted maintenance provider for assistance. Small Business Support Center contacts are as follows.
+1 866 606 1866 (toll free from within North America)
+1 408 418 1866 (toll call from anywhere in the world)
Customers should have their product serial number available.
Refer to http://www.cisco.com/en/US/support/tsd_cisco_small_business_support_center_contacts.html for additional support contact information, including localized telephone numbers, and instructions and e-mail addresses for use in various languages.
Customers with Service Contracts +-------------------------------
See the Obtaining Fixed Software section of this advisory.
Customers using Third Party Support Organizations +------------------------------------------------
See the Obtaining Fixed Software section of this advisory.
Customers without Service Contracts +----------------------------------
See the Obtaining Fixed Software section of this advisory.
Exploitation and Public Announcements
The Cisco PSIRT is not aware of any malicious use of the vulnerability described in this advisory. This vulnerability was demonstrated at a conference in San Jose, CA on November 2, 2011.
This vulnerability was reported to Cisco by Michal Sajdak of Securitum, Poland.
Status of this Notice: Final
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors.
Distribution
This advisory is posted on Cisco's worldwide website at:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20111102-srp500
In addition to worldwide web posting, a text version of this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the following e-mail and Usenet news recipients.
- cust-security-announce@cisco.com
- first-teams@first.org
- bugtraq@securityfocus.com
- vulnwatch@vulnwatch.org
- cisco@spot.colorado.edu
- cisco-nsp@puck.nether.net
- full-disclosure@lists.grok.org.uk
- comp.dcom.sys.cisco@newsgate.cisco.com
Future updates of this advisory, if any, will be placed on Cisco's worldwide website, but may or may not be actively announced on mailing lists or newsgroups. Users concerned about this problem are encouraged to check the above URL for any updates.
Revision History
+------------------------------------------------------------+ | Revision 1.0 | 2011-November-2 | Initial draft release. | +------------------------------------------------------------+
Cisco Security Procedures
Complete information on reporting security vulnerabilities in Cisco products, obtaining assistance with security incidents, and registering to receive security information from Cisco, is available on Cisco's worldwide website at http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html. This includes instructions for press inquiries regarding Cisco security notices. All Cisco security advisories are available at http://www.cisco.com/go/psirt.
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux)
iF4EAREIAAYFAk6wn+cACgkQQXnnBKKRMNAY5wD8CplHH8zrwzTGPHmrOFJyeYIm kg/OjEjxe60spU5+IbcA/3gNeptZTKm+fZ/lVJOIfB3RK2Gya7J0tDtnSA7Hna/j =XkML -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201111-0147",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "small business srp527w",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "*"
},
{
"model": "small business srp520 series",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "1.01.01"
},
{
"model": "small business srp526w",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "*"
},
{
"model": "small business srp520 series",
"scope": "lte",
"trust": 1.0,
"vendor": "cisco",
"version": "1.01.23"
},
{
"model": "small business srp547w",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "*"
},
{
"model": "small business srp521w",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "*"
},
{
"model": "small business srp546w",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "*"
},
{
"model": "small business srp540 series",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "1.02.00"
},
{
"model": "small business srp541w",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "*"
},
{
"model": "small business srp520 series",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "1.00.06"
},
{
"model": "small business srp540 series",
"scope": "lte",
"trust": 1.0,
"vendor": "cisco",
"version": "1.02.01_mr2"
},
{
"model": "small business srp520 series",
"scope": "eq",
"trust": 1.0,
"vendor": "cisco",
"version": "1.01.19_mr3"
},
{
"model": "small business",
"scope": "lt",
"trust": 0.8,
"vendor": "cisco",
"version": "srp521w firmware 1.1.24"
},
{
"model": "small business",
"scope": "lt",
"trust": 0.8,
"vendor": "cisco",
"version": "srp526w firmware 1.1.24"
},
{
"model": "small business",
"scope": "lt",
"trust": 0.8,
"vendor": "cisco",
"version": "srp527w firmware 1.1.24"
},
{
"model": "small business",
"scope": "lt",
"trust": 0.8,
"vendor": "cisco",
"version": "srp541w firmware 1.2.1"
},
{
"model": "small business",
"scope": "lt",
"trust": 0.8,
"vendor": "cisco",
"version": "srp546w firmware 1.2.1"
},
{
"model": "small business",
"scope": "lt",
"trust": 0.8,
"vendor": "cisco",
"version": "srp547w firmware 1.2.1"
},
{
"model": "small business srp527w",
"scope": null,
"trust": 0.6,
"vendor": "cisco",
"version": null
},
{
"model": "small business srp546w",
"scope": null,
"trust": 0.6,
"vendor": "cisco",
"version": null
},
{
"model": "small business srp526w",
"scope": null,
"trust": 0.6,
"vendor": "cisco",
"version": null
},
{
"model": "small business srp521w",
"scope": null,
"trust": 0.6,
"vendor": "cisco",
"version": null
},
{
"model": "small business srp547w",
"scope": null,
"trust": 0.6,
"vendor": "cisco",
"version": null
},
{
"model": "small business srp541w",
"scope": null,
"trust": 0.6,
"vendor": "cisco",
"version": null
},
{
"model": "srp547w",
"scope": "ne",
"trust": 0.3,
"vendor": "cisco",
"version": "1.2.1"
},
{
"model": "srp527w",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "0"
},
{
"model": "srp546w",
"scope": "ne",
"trust": 0.3,
"vendor": "cisco",
"version": "1.2.1"
},
{
"model": "srp526w",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "0"
},
{
"model": "srp541w",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "0"
},
{
"model": "srp547w",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "0"
},
{
"model": "srp527w",
"scope": "ne",
"trust": 0.3,
"vendor": "cisco",
"version": "1.1.24"
},
{
"model": "srp521w",
"scope": "ne",
"trust": 0.3,
"vendor": "cisco",
"version": "1.1.24"
},
{
"model": "srp541w",
"scope": "ne",
"trust": 0.3,
"vendor": "cisco",
"version": "1.2.1"
},
{
"model": "srp546w",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "0"
},
{
"model": "srp521w",
"scope": "eq",
"trust": 0.3,
"vendor": "cisco",
"version": "0"
},
{
"model": "srp526w",
"scope": "ne",
"trust": 0.3,
"vendor": "cisco",
"version": "1.1.24"
}
],
"sources": [
{
"db": "BID",
"id": "50495"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002754"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-121"
},
{
"db": "NVD",
"id": "CVE-2011-4005"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:cisco:small_business_srp521w:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:cisco:small_business_srp526w:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:cisco:small_business_srp527w:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:cisco:small_business_srp520_series_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.01.23",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:small_business_srp520_series_firmware:1.01.19_mr3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:small_business_srp520_series_firmware:1.01.01:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:small_business_srp520_series_firmware:1.00.06:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:cisco:small_business_srp546w:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:cisco:small_business_srp547w:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:cisco:small_business_srp541w:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:cisco:small_business_srp540_series_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.02.01_mr2",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:small_business_srp540_series_firmware:1.02.00:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4005"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Michal Sajdak of Securitum",
"sources": [
{
"db": "BID",
"id": "50495"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-121"
}
],
"trust": 0.9
},
"cve": "CVE-2011-4005",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 9.3,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2011-4005",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.9,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "VHN-51950",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2011-4005",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201111-121",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-51950",
"trust": 0.1,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2011-4005",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-51950"
},
{
"db": "VULMON",
"id": "CVE-2011-4005"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002754"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-121"
},
{
"db": "NVD",
"id": "CVE-2011-4005"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site request forgery (CSRF) vulnerability in the Services Ready Platform Configuration Utility web interface on the Cisco Small Business SRP521W, SRP526W, and SRP527W with firmware before 1.1.24 and the Small Business SRP541W, SRP546W, and SRP547W with firmware before 1.2.1 allows remote attackers to hijack the authentication of administrators for requests that execute arbitrary commands, aka Bug ID CSCtr45124. The problem is ID CSCtr45124 It is a problem.A third party may be able to hijack the administrator\u0027s authentication requesting the execution of arbitrary commands. Cisco Small Business SRP500 Series Appliances are prone to a remote command-injection vulnerability. \nSuccessful exploits will result in the execution of arbitrary attacker-supplied commands in the context of the root user. This may facilitate a complete compromise. \nThis issue is being tracked by Cisco bug ID CSCtr45124. ----------------------------------------------------------------------\n\nOvum says ad hoc tools are out-dated. The best practice approach?\nFast vulnerability intelligence, threat handling, and setup in one tool. \n\nRead the new report on the Secunia VIM:\nhttp://secunia.com/products/corporate/vim/ovum_2011_request/ \n\n----------------------------------------------------------------------\n\nTITLE:\nCisco Small Business SRP520 / SRP540 Series Command Injection\nVulnerability\n\nSECUNIA ADVISORY ID:\nSA46664\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/46664/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=46664\n\nRELEASE DATE:\n2011-11-03\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/46664/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/46664/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=46664\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nA vulnerability has been reported in Cisco Small Business SRP520 /\nSRP540 series, which can be exploited by malicious people to\ncompromise a vulnerable system. by tricking a logged-in administrator into\nfollowing a malicious link. \n* Cisco SRP526W versions prior to 1.1.24. \n* Cisco SRP527W versions prior to 1.1.24. \n* Cisco SRP541W versions prior to 1.2.1. \n* Cisco SRP546W versions prior to 1.2.1. \n* Cisco SRP547W versions prior to 1.2.1. \n\nSOLUTION:\nUpdate to version 1.1.24 or 1.2.1. \n\nPROVIDED AND/OR DISCOVERED BY:\nThe vendor credits Michal Sajdak, Securitum. \n\nORIGINAL ADVISORY:\nhttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20111102-srp500\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nCisco Security Advisory: Cisco Small Business SRP500 Series Command\nInjection Vulnerability\n\nAdvisory ID: cisco-sa-20111102-srp500\n\nRevision 1.0\n\nFor Public Release 2011 November 2 16:00 UTC (GMT)\n\n+--------------------------------------------------------------------\n\nSummary\n=======\n\nCisco Small Business SRP500 Series Services Ready Platforms contain an\noperating system command injection vulnerability. \n\nCisco has released free software updates that address this\nvulnerability. \n\nWorkarounds that mitigate this vulnerability are available. \n\nThis advisory is posted at\nhttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20111102-srp500. \n\nAffected Products\n=================\n\nVulnerable Products\n+------------------\n\nThe following Cisco Small Business SRP520 Series models are affected\nif running firmware prior to version 1.1.24:\n\n * Cisco SRP521W\n * Cisco SRP526W\n * Cisco SRP527W\n\nThe following Cisco Small Business SRP540 Series models are affected if\nrunning firmware prior to version 1.2.1:\n\n * Cisco SRP541W\n * Cisco SRP546W\n * Cisco SRP547W\n\nTo view the firmware version on a device, log in to the Services Ready\nPlatform Configuration Utility and navigate to the \"Status \u003e Router\"\npage to view information about the SRP and its firmware status. The\n\"Firmware Version\" field indicates the current running version of\nfirmware on the SRP500 Series device. \n\nProducts Confirmed Not Vulnerable\n+--------------------------------\n\nNo other Cisco products are currently known to be affected by this\nvulnerability. \n\nDetails\n=======\n\nCisco Small Business SRP500 Series Services Ready Platforms are\nflexible, cost-effective, fixed-configuration customer premises\nequipment (CPE) with embedded intelligence to enable service providers\nto create, provision, and deploy premium revenue-generating\nservices -- a variety of high-quality IP voice, data, security, and\nwireless services -- to small businesses on an as-needed basis. \n\nFor this vulnerability to be exploited, a remote attacker must\neither entice an administrator to access a crafted link or perform a\nman-in-the-middle attack, intercepting an authenticated session. \n\nVulnerability Scoring Details\n=============================\n\nCisco has provided scores for the vulnerability in this advisory\nbased on the Common Vulnerability Scoring System (CVSS). The CVSS\nscoring in this Security Advisory is done in accordance with CVSS\nversion 2.0. \n\nCVSS is a standards-based scoring method that conveys vulnerability\nseverity and helps determine urgency and priority of response. \n\nCisco has provided a base and temporal score. Customers can then\ncompute environmental scores to assist in determining the impact of\nthe vulnerability in individual networks. \n\nCisco has provided an FAQ to answer additional questions regarding\nCVSS at:\n\nhttp://www.cisco.com/web/about/security/intelligence/cvss-qandas.html\n\nCisco has also provided a CVSS calculator to help compute the\nenvironmental impact for individual networks at:\n\nhttp://intellishield.cisco.com/security/alertmanager/cvss\n\n* CSCtr45124 (\"Cisco Small Business SRP500 Series Services Ready\nPlatforms Command Injection Vulnerability\")\n\nCVSS Base Score - 9.3\n Access Vector - Network\n Access Complexity - Medium\n Authentication - None\n Confidentiality Impact - Complete\n Integrity Impact - Complete\n Availability Impact - Complete\n\nCVSS Temporal Score - 7.7\n Exploitability - Functional\n Remediation Level - Official-Fix\n Report Confidence - Confirmed\n\nImpact\n======\n\nSuccessful exploitation of the vulnerability may result in the execution\nof arbitrary commands on the device. \n\nSoftware Versions and Fixes\n===========================\n\nWhen considering software upgrades, also consult\nhttp://www.cisco.com/go/psirt and any subsequent advisories to determine\nexposure and a complete upgrade solution. \n\nIn all cases, customers should exercise caution to be certain the\ndevices to be upgraded contain sufficient memory and that current\nhardware and software configurations will continue to be supported\nproperly by the new release. If the information is not clear, contact\nthe Cisco Small Business Support Center or your contracted maintenance\nprovider for assistance. \n\nThis vulnerability has been fixed in the following firmware\nversions:\n\n+------------------------------------------------------------+\n| Affected Product | First Fixed Release |\n|--------------------------+---------------------------------|\n| Cisco SRP521W | 1.1.24 |\n|--------------------------+---------------------------------|\n| Cisco SRP526W | 1.1.24 |\n|--------------------------+---------------------------------|\n| Cisco SRP527W | 1.1.24 |\n|--------------------------+---------------------------------|\n| Cisco SRP541W | 1.2.1 |\n|--------------------------+---------------------------------|\n| Cisco SRP546W | 1.2.1 |\n|--------------------------+---------------------------------|\n| Cisco SRP547W | 1.2.1 |\n+------------------------------------------------------------+\n\nThe latest Cisco Small Business SRP500 Series Services Ready\nPlatforms firmware can be downloaded at\nhttp://www.cisco.com/cisco/software/navigator.html?mdfid=282736194\u0026i=rm\n\nWorkarounds\n===========\n\nThe following mitigations help limit exposure to this vulnerability. \n\n * Disable Remote Management\n\n Caution: Do not disable remote management if administrators\n manage devices via the WAN connection. This action will result in\n a loss of management connectivity to the device. \n\n Remote Management is enabled by default. Administrators can disable\n this feature by choosing \"Administration \u003e Web Access Management\". \n Change the setting for the Remote Management field to Disabled. \n\n Disabling remote management limits exposure because the\n vulnerability can then be exploited from the inter-LAN network only. \n\n * Limit Remote Management Access to Specific IP Addresses\n\n If remote management is required, secure the device so that it can\n be accessed by certain IP addresses only, rather than the default\n setting of All IP Addresses. After choosing \"Administration \u003e Web\n Access Management\", an administrator can change the Allowed Remote\n IP Address setting to ensure that only devices with specified IP\n addresses can access the device. \n\nObtaining Fixed Software\n========================\n\nCisco has released free software updates that address this\nvulnerability. Prior to deploying software, customers should consult\ntheir maintenance provider or check the software for feature set\ncompatibility and known issues specific to their environment. \n\nCustomers may only install and expect support for the feature\nsets they have purchased. By installing, downloading, accessing\nor otherwise using such software upgrades, customers agree to be\nbound by the terms of Cisco\u0027s software license terms found at\nhttp://www.cisco.com/en/US/docs/general/warranty/English/EU1KEN_.html,\nor as otherwise set forth at Cisco.com Downloads at\nhttp://www.cisco.com/public/sw-center/sw-usingswc.shtml. \n\nDo not contact psirt@cisco.com or security-alert@cisco.com for\nsoftware upgrades. \n\nCustomers should obtain upgraded software through their regular\nupdate channels. For most customers, this means that upgrades should\nbe obtained through the Software Center on Cisco\u0027s worldwide website\nat http://www.cisco.com. \n\nIf the information is not clear, please contact the Cisco Small\nBusiness Support Center or your contracted maintenance provider for\nassistance. Small Business Support Center contacts are as follows. \n\n+1 866 606 1866 (toll free from within North America)\n\n+1 408 418 1866 (toll call from anywhere in the world)\n\nCustomers should have their product serial number available. \n\nRefer to\nhttp://www.cisco.com/en/US/support/tsd_cisco_small_business_support_center_contacts.html\nfor additional support contact information, including\nlocalized telephone numbers, and instructions and e-mail addresses for\nuse in various languages. \n\nCustomers with Service Contracts\n+-------------------------------\n\nSee the Obtaining Fixed Software section of this advisory. \n\nCustomers using Third Party Support Organizations\n+------------------------------------------------\n\nSee the Obtaining Fixed Software section of this advisory. \n\nCustomers without Service Contracts\n+----------------------------------\n\nSee the Obtaining Fixed Software section of this advisory. \n\nExploitation and Public Announcements\n=====================================\n\nThe Cisco PSIRT is not aware of any malicious use of the\nvulnerability described in this advisory. This vulnerability was\ndemonstrated at a conference in San Jose, CA on November 2, 2011. \n\nThis vulnerability was reported to Cisco by Michal Sajdak of\nSecuritum, Poland. \n\nStatus of this Notice: Final\n============================\n\nTHIS DOCUMENT IS PROVIDED ON AN \"AS IS\" BASIS AND DOES NOT IMPLY ANY\nKIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF\nMERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE\nINFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS\nAT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS\nDOCUMENT AT ANY TIME. \n\nA stand-alone copy or Paraphrase of the text of this document that\nomits the distribution URL in the following section is an\nuncontrolled copy, and may lack important information or contain\nfactual errors. \n\n\nDistribution\n============\n\nThis advisory is posted on Cisco\u0027s worldwide website at:\n\nhttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20111102-srp500\n\nIn addition to worldwide web posting, a text version of this notice\nis clear-signed with the Cisco PSIRT PGP key and is posted to the\nfollowing e-mail and Usenet news recipients. \n\n * cust-security-announce@cisco.com\n * first-teams@first.org\n * bugtraq@securityfocus.com\n * vulnwatch@vulnwatch.org\n * cisco@spot.colorado.edu\n * cisco-nsp@puck.nether.net\n * full-disclosure@lists.grok.org.uk\n * comp.dcom.sys.cisco@newsgate.cisco.com\n\nFuture updates of this advisory, if any, will be placed on Cisco\u0027s\nworldwide website, but may or may not be actively announced on\nmailing lists or newsgroups. Users concerned about this problem are\nencouraged to check the above URL for any updates. \n\n\nRevision History\n================\n\n+------------------------------------------------------------+\n| Revision 1.0 | 2011-November-2 | Initial draft release. |\n+------------------------------------------------------------+\n\nCisco Security Procedures\n=========================\n\nComplete information on reporting security vulnerabilities\nin Cisco products, obtaining assistance with security\nincidents, and registering to receive security information\nfrom Cisco, is available on Cisco\u0027s worldwide website at\nhttp://www.cisco.com/en/US/products/products_security_vulnerability_policy.html. \nThis includes instructions for press inquiries regarding\nCisco security notices. All Cisco security advisories are available at\nhttp://www.cisco.com/go/psirt. \n\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.11 (GNU/Linux)\n\niF4EAREIAAYFAk6wn+cACgkQQXnnBKKRMNAY5wD8CplHH8zrwzTGPHmrOFJyeYIm\nkg/OjEjxe60spU5+IbcA/3gNeptZTKm+fZ/lVJOIfB3RK2Gya7J0tDtnSA7Hna/j\n=XkML\n-----END PGP SIGNATURE-----\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4005"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002754"
},
{
"db": "BID",
"id": "50495"
},
{
"db": "VULHUB",
"id": "VHN-51950"
},
{
"db": "VULMON",
"id": "CVE-2011-4005"
},
{
"db": "PACKETSTORM",
"id": "106582"
},
{
"db": "PACKETSTORM",
"id": "106528"
}
],
"trust": 2.25
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-51950",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-51950"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2011-4005",
"trust": 3.0
},
{
"db": "SECUNIA",
"id": "46664",
"trust": 1.9
},
{
"db": "BID",
"id": "50495",
"trust": 1.5
},
{
"db": "SECTRACK",
"id": "1026266",
"trust": 1.2
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002754",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201111-121",
"trust": 0.7
},
{
"db": "CISCO",
"id": "20111102 CISCO SMALL BUSINESS SRP500 SERIES COMMAND INJECTION VULNERABILITY",
"trust": 0.6
},
{
"db": "NSFOCUS",
"id": "18116",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "106528",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-51950",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2011-4005",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "106582",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-51950"
},
{
"db": "VULMON",
"id": "CVE-2011-4005"
},
{
"db": "BID",
"id": "50495"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002754"
},
{
"db": "PACKETSTORM",
"id": "106582"
},
{
"db": "PACKETSTORM",
"id": "106528"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-121"
},
{
"db": "NVD",
"id": "CVE-2011-4005"
}
]
},
"id": "VAR-201111-0147",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-51950"
}
],
"trust": 0.01
},
"last_update_date": "2024-02-13T22:57:00.663000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "cisco-sa-20111102-srp500",
"trust": 0.8,
"url": "http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20111102-srp500"
},
{
"title": "24495",
"trust": 0.8,
"url": "http://tools.cisco.com/security/center/viewalert.x?alertid=24495"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-002754"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-352",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-51950"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002754"
},
{
"db": "NVD",
"id": "CVE-2011-4005"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.3,
"url": "http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20111102-srp500"
},
{
"trust": 1.8,
"url": "http://secunia.com/advisories/46664"
},
{
"trust": 1.2,
"url": "http://www.securityfocus.com/bid/50495"
},
{
"trust": 1.2,
"url": "http://www.securitytracker.com/id?1026266"
},
{
"trust": 1.2,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71103"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-4005"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-4005"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/18116"
},
{
"trust": 0.3,
"url": "http://www.cisco.com/en/us/products/ps10500/index.html"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/352.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_intelligence/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/products/corporate/vim/ovum_2011_request/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/46664/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/46664/#comments"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=46664"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/en/us/products/products_security_vulnerability_policy.html."
},
{
"trust": 0.1,
"url": "http://www.cisco.com/go/psirt"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/en/us/docs/general/warranty/english/eu1ken_.html,"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/en/us/support/tsd_cisco_small_business_support_center_contacts.html"
},
{
"trust": 0.1,
"url": "http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2011-4005"
},
{
"trust": 0.1,
"url": "http://www.cisco.com."
},
{
"trust": 0.1,
"url": "http://www.cisco.com/go/psirt."
},
{
"trust": 0.1,
"url": "http://www.cisco.com/cisco/software/navigator.html?mdfid=282736194\u0026i=rm"
},
{
"trust": 0.1,
"url": "http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20111102-srp500."
},
{
"trust": 0.1,
"url": "http://www.cisco.com/public/sw-center/sw-usingswc.shtml."
},
{
"trust": 0.1,
"url": "http://intellishield.cisco.com/security/alertmanager/cvss"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-51950"
},
{
"db": "VULMON",
"id": "CVE-2011-4005"
},
{
"db": "BID",
"id": "50495"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002754"
},
{
"db": "PACKETSTORM",
"id": "106582"
},
{
"db": "PACKETSTORM",
"id": "106528"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-121"
},
{
"db": "NVD",
"id": "CVE-2011-4005"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-51950"
},
{
"db": "VULMON",
"id": "CVE-2011-4005"
},
{
"db": "BID",
"id": "50495"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002754"
},
{
"db": "PACKETSTORM",
"id": "106582"
},
{
"db": "PACKETSTORM",
"id": "106528"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-121"
},
{
"db": "NVD",
"id": "CVE-2011-4005"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-11-03T00:00:00",
"db": "VULHUB",
"id": "VHN-51950"
},
{
"date": "2011-11-03T00:00:00",
"db": "VULMON",
"id": "CVE-2011-4005"
},
{
"date": "2011-11-02T00:00:00",
"db": "BID",
"id": "50495"
},
{
"date": "2011-11-09T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-002754"
},
{
"date": "2011-11-04T06:00:00",
"db": "PACKETSTORM",
"id": "106582"
},
{
"date": "2011-11-02T22:50:26",
"db": "PACKETSTORM",
"id": "106528"
},
{
"date": "1900-01-01T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201111-121"
},
{
"date": "2011-11-03T10:55:08.700000",
"db": "NVD",
"id": "CVE-2011-4005"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-08-29T00:00:00",
"db": "VULHUB",
"id": "VHN-51950"
},
{
"date": "2017-08-29T00:00:00",
"db": "VULMON",
"id": "CVE-2011-4005"
},
{
"date": "2011-11-02T00:00:00",
"db": "BID",
"id": "50495"
},
{
"date": "2011-11-09T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-002754"
},
{
"date": "2011-11-14T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201111-121"
},
{
"date": "2017-08-29T01:30:26.507000",
"db": "NVD",
"id": "CVE-2011-4005"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "106528"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-121"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cisco Small Business Vulnerable to cross-site request forgery",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-002754"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "cross-site request forgery",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201111-121"
}
],
"trust": 0.6
}
}
CERTFR-2023-AVI-0026
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Cisco. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | N/A | Cisco BroadWorks Xtended Services Platform version 22.0 (Cisco recommande de migrer en version 23 avec les derniers correctifs de sécurité) | ||
| Cisco | N/A | Cisco BroadWorks Xtended Services Platform version 23.0 sans les correctifs de sécurité AP.xsp.23.0.1075.ap384245 et AP.platform.23.0.1075.ap384245 | ||
| Cisco | N/A | Cisco SIP sur les téléphones IP sans-fil 8821 versions antérieures à 11.0(6)SR4 | ||
| Cisco | N/A | Cisco Industrial Network Director (IND) versions antérieures à 1.7.0 | ||
| Cisco | N/A | Cisco SIP sur les téléphones IP des séries 7800 et 8800 versions antérieures à 14.1(1)SR2 | ||
| Cisco | Small Business | Routeurs Cisco Small Business RV016, RV042, RV042G et RV082 (Cisco indique que ces routeurs sont en fin de vie) | ||
| Cisco | N/A | Cisco BroadWorks Application Delivery Platform Device Management versions 22.0 sans les correctifs de sécurité ADP_Rel_2022.11_1.273 et dms_2022.11_1.273 |
References
| Title | Publication Time | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Cisco BroadWorks Xtended Services Platform version 22.0 (Cisco recommande de migrer en version 23 avec les derniers correctifs de s\u00e9curit\u00e9)",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco BroadWorks Xtended Services Platform version 23.0 sans les correctifs de s\u00e9curit\u00e9 AP.xsp.23.0.1075.ap384245 et AP.platform.23.0.1075.ap384245",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco SIP sur les t\u00e9l\u00e9phones IP sans-fil 8821 versions ant\u00e9rieures \u00e0 11.0(6)SR4",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Industrial Network Director (IND) versions ant\u00e9rieures \u00e0 1.7.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco SIP sur les t\u00e9l\u00e9phones IP des s\u00e9ries 7800 et 8800 versions ant\u00e9rieures \u00e0 14.1(1)SR2",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Routeurs Cisco Small Business RV016, RV042, RV042G et RV082 (Cisco indique que ces routeurs sont en fin de vie)",
"product": {
"name": "Small Business",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco BroadWorks Application Delivery Platform Device Management versions 22.0 sans les correctifs de s\u00e9curit\u00e9 ADP_Rel_2022.11_1.273 et dms_2022.11_1.273",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-20037",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-20037"
},
{
"name": "CVE-2023-20018",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-20018"
},
{
"name": "CVE-2023-20038",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-20038"
},
{
"name": "CVE-2023-20020",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-20020"
},
{
"name": "CVE-2023-20025",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-20025"
},
{
"name": "CVE-2023-20026",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-20026"
}
],
"links": [],
"reference": "CERTFR-2023-AVI-0026",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-01-12T00:00:00.000000"
},
{
"description": "Correction coquille.",
"revision_date": "2023-01-17T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Cisco.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance\net un contournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ip-phone-auth-bypass-pSqxZRPR du 11 janvier 2023",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ip-phone-auth-bypass-pSqxZRPR"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-sbr042-multi-vuln-ej76Pke5 du 11 janvier 2023",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sbr042-multi-vuln-ej76Pke5"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ind-fZyVjJtG du 11 janvier 2023",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ind-fZyVjJtG"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-bw-dos-HpkeYzp du 11 janvier 2023",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bw-dos-HpkeYzp"
}
]
}
CERTFR-2021-AVI-761
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Cisco. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une élévation de privilèges.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | N/A | Cisco Intersight Virtual Appliance versions antérieures à 1.0.9-302 | ||
| Cisco | N/A | Cisco AsyncOS pour Cisco WSA versions 12.5.x antérieures à 12.5.2-007 | ||
| Cisco | Identity Services Engine | Cisco Identity Services Engine versions antérieures à 2.6 Patch10 | ||
| Cisco | Identity Services Engine | Cisco Identity Services Engine versions 2.7 antérieures à 2.7 Patch5 | ||
| Cisco | N/A | Cisco AsyncOS pour Cisco WSA versions 12.0.x antérieures à 12.0.3-005 | ||
| Cisco | Small Business | Cisco Small Business 220 Series Smart Switches versions antérieures à 1.2.1.2 | ||
| Cisco | N/A | ATA 190 Analog Telephone Adapter (produit en fin de vie) | ||
| Cisco | Identity Services Engine | Cisco Identity Services Engine versions 3.x antérieures à 3.1 | ||
| Cisco | N/A | ATA 192 Multiplatform Analog Telephone Adapter versions antérieures à 11.2.1 | ||
| Cisco | N/A | Cisco AsyncOS pour Cisco WSA versions 14.0.x antérieures à 14.0.1-014 | ||
| Cisco | N/A | Cisco AnyConnect Secure Mobility Client pour Linux et Mac OS versions antérieures à 4.10.03104 | ||
| Cisco | N/A | ATA 191 Multiplatform Analog Telephone Adapter versions antérieures à 11.2.1 | ||
| Cisco | N/A | ATA 191 Analog Telephone Adapter versions antérieures à 12.0(1)SR4 |
References
| Title | Publication Time | Tags | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Cisco Intersight Virtual Appliance versions ant\u00e9rieures \u00e0 1.0.9-302",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco AsyncOS pour Cisco WSA versions 12.5.x ant\u00e9rieures \u00e0 12.5.2-007",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Identity Services Engine versions ant\u00e9rieures \u00e0 2.6 Patch10",
"product": {
"name": "Identity Services Engine",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Identity Services Engine versions 2.7 ant\u00e9rieures \u00e0 2.7 Patch5",
"product": {
"name": "Identity Services Engine",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco AsyncOS pour Cisco WSA versions 12.0.x ant\u00e9rieures \u00e0 12.0.3-005",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Small Business 220 Series Smart Switches versions ant\u00e9rieures \u00e0 1.2.1.2",
"product": {
"name": "Small Business",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "ATA 190 Analog Telephone Adapter (produit en fin de vie)",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Identity Services Engine versions 3.x ant\u00e9rieures \u00e0 3.1",
"product": {
"name": "Identity Services Engine",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "ATA 192 Multiplatform Analog Telephone Adapter versions ant\u00e9rieures \u00e0 11.2.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco AsyncOS pour Cisco WSA versions 14.0.x ant\u00e9rieures \u00e0 14.0.1-014",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco AnyConnect Secure Mobility Client pour Linux et Mac OS versions ant\u00e9rieures \u00e0 4.10.03104",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "ATA 191 Multiplatform Analog Telephone Adapter versions ant\u00e9rieures \u00e0 11.2.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "ATA 191 Analog Telephone Adapter versions ant\u00e9rieures \u00e0 12.0(1)SR4",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2021-34788",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34788"
},
{
"name": "CVE-2021-34779",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34779"
},
{
"name": "CVE-2021-1594",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1594"
},
{
"name": "CVE-2021-34775",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34775"
},
{
"name": "CVE-2021-34777",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34777"
},
{
"name": "CVE-2021-34780",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34780"
},
{
"name": "CVE-2021-34735",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34735"
},
{
"name": "CVE-2021-34698",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34698"
},
{
"name": "CVE-2021-34710",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34710"
},
{
"name": "CVE-2021-34748",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34748"
},
{
"name": "CVE-2021-34776",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34776"
},
{
"name": "CVE-2021-34778",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34778"
}
],
"links": [],
"reference": "CERTFR-2021-AVI-761",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2021-10-07T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Cisco.\nElles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code\narbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une \u00e9l\u00e9vation de\nprivil\u00e8ges.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-wsa-dos-fmHdKswk du 06 octobre 2021",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wsa-dos-fmHdKswk"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ise-priv-esc-UwqPrBM3 du 06 octobre 2021",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-priv-esc-UwqPrBM3"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ata19x-multivuln-A4J57F3 du 06 octobre 2021",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ata19x-multivuln-A4J57F3"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ucsi2-command-inject-CGyC8y2R du 06 octobre 2021",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucsi2-command-inject-CGyC8y2R"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-anyconnect-lib-hija-cAFB7x4q du 06 octobre 2021",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-lib-hija-cAFB7x4q"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-sb220-lldp-multivuls-mVRUtQ8T du 06 octobre 2021",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb220-lldp-multivuls-mVRUtQ8T"
}
]
}
CERTFR-2021-AVI-470
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Cisco. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un contournement de la politique de sécurité et une atteinte à l'intégrité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | N/A | Web Security Appliance versions antérieures à 12.0.3-005 | ||
| Cisco | N/A | Email Security Appliance versions antérieures à 12.5.3-035 | ||
| Cisco | N/A | Email Security Appliance versions 13.0.x antérieures à 13.0.0-030 | ||
| Cisco | N/A | Cisco AnyConnect Secure Mobility Client for Windows versions antérieures à 4.10.01075 (avec le module VPN Posture (HostScan) installé) | ||
| Cisco | N/A | Web Security Appliance versions antérieures à 11.8.3-021 | ||
| Cisco | N/A | Web Security Appliance versions antérieures à 12.5.1-043 | ||
| Cisco | N/A | Email Security Appliance versions 13.5.x antérieures à 13.5.3-010 | ||
| Cisco | N/A | Cisco DNA Center Software versions antérieures à 2.2.2.1 sans le dernier correctif ou 2.2.2.3 | ||
| Cisco | Small Business | Cisco Small Business 220 Series Smart Switches firmware versions antérieures à 1.2.0.6 |
References
| Title | Publication Time | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Web Security Appliance versions ant\u00e9rieures \u00e0 12.0.3-005",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Email Security Appliance versions ant\u00e9rieures \u00e0 12.5.3-035",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Email Security Appliance versions 13.0.x ant\u00e9rieures \u00e0 13.0.0-030",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco AnyConnect Secure Mobility Client for Windows versions ant\u00e9rieures \u00e0 4.10.01075 (avec le module VPN Posture (HostScan) install\u00e9)",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Web Security Appliance versions ant\u00e9rieures \u00e0 11.8.3-021",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Web Security Appliance versions ant\u00e9rieures \u00e0 12.5.1-043",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Email Security Appliance versions 13.5.x ant\u00e9rieures \u00e0 13.5.3-010",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco DNA Center Software versions ant\u00e9rieures \u00e0 2.2.2.1 sans le dernier correctif ou 2.2.2.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Small Business 220 Series Smart Switches firmware versions ant\u00e9rieures \u00e0 1.2.0.6",
"product": {
"name": "Small Business",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2021-1566",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1566"
},
{
"name": "CVE-2021-1571",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1571"
},
{
"name": "CVE-2021-1541",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1541"
},
{
"name": "CVE-2021-1134",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1134"
},
{
"name": "CVE-2021-1542",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1542"
},
{
"name": "CVE-2021-1543",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1543"
}
],
"links": [],
"reference": "CERTFR-2021-AVI-470",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2021-06-17T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Cisco.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un contournement de la\npolitique de s\u00e9curit\u00e9 et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-dnac-certvalid-USEj2CZk du 16 juin 2021",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnac-certvalid-USEj2CZk"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-anyconnect-pos-dll-ff8j6dFv du 16 juin 2021",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-pos-dll-ff8j6dFv"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ciscosb-multivulns-Wwyb7s5E du 16 juin 2021",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ciscosb-multivulns-Wwyb7s5E"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-esa-wsa-cert-vali-n8L97RW du 16 juin 2021",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-wsa-cert-vali-n8L97RW"
}
]
}
CERTFR-2021-AVI-246
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Cisco. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | ClamAV | ClamAV pour Windows versions antérieures à 0.103.2 | ||
| Cisco | Small Business | les routeurs Cisco Small Business RV110W, RV130, RV130W et RV215W (ces produits sont en fin de vie donc aucun correctif ne sera publié pour la vulnérabilité critique CVE-2021-1459) | ||
| Cisco | N/A | Cisco Unified CM IM&P versions antérieures à 11.5(1)SU9 | ||
| Cisco | Small Business | les routeurs Cisco Small Business RV134W versions antérieures à 1.0.1.21 | ||
| Cisco | SD-WAN vManage | Cisco SD-WAN vManage versions 19.x et 20.x antérieures à 20.3.3 | ||
| Cisco | SD-WAN vManage | Cisco SD-WAN vManage versions 20.4.x antérieures à 20.4.1 | ||
| Cisco | N/A | Immunet versions antérieures à 7.4.0 | ||
| Cisco | N/A | Cisco AMP for Endpoints pour Windows versions antérieures à 7.3.15 | ||
| Cisco | Unity Connection | Cisco Unity Connection versions antérieures à 11.5(1)SU9 | ||
| Cisco | Small Business | les routeurs Cisco Small Business RV132W versions antérieures à 1.0.1.15 | ||
| Cisco | Unity Connection | Cisco Unity Connection versions 12.0.x et 12.5.x antérieures à 12.5(1)SU4 | ||
| Cisco | Small Business | les routeurs Cisco Small Business RV160, RV160W, RV260, RV260P et RV260W versions antérieures à 1.0.01.03 | ||
| Cisco | N/A | Cisco Unified CM IM&P versions 12.0.x et 12.5.x antérieures à 12.5(1)SU4 | ||
| Cisco | N/A | Cisco Unified CM et Unified CM SME versions 12.0.x et 12.5.x antérieures à 12.5(1)SU4 | ||
| Cisco | SD-WAN vManage | Cisco SD-WAN vManage versions antérieures à 19.2.4 | ||
| Cisco | N/A | Cisco Unified CM et Unified CM SME versions antérieures à 11.5(1)SU9 | ||
| Cisco | Small Business | les routeurs Cisco Small Business RV340, RV340W, RV345 et RV345P versions antérieures à 1.0.03.21 | ||
| Cisco | N/A | Cisco Prime License Manager versions antérieures à 11.5(1)SU9 |
References
| Title | Publication Time | Tags | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "ClamAV pour Windows versions ant\u00e9rieures \u00e0 0.103.2",
"product": {
"name": "ClamAV",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "les routeurs Cisco Small Business RV110W, RV130, RV130W et RV215W (ces produits sont en fin de vie donc aucun correctif ne sera publi\u00e9 pour la vuln\u00e9rabilit\u00e9 critique CVE-2021-1459)",
"product": {
"name": "Small Business",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Unified CM IM\u0026P versions ant\u00e9rieures \u00e0 11.5(1)SU9",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "les routeurs Cisco Small Business RV134W versions ant\u00e9rieures \u00e0 1.0.1.21",
"product": {
"name": "Small Business",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco SD-WAN vManage versions 19.x et 20.x ant\u00e9rieures \u00e0 20.3.3",
"product": {
"name": "SD-WAN vManage",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco SD-WAN vManage versions 20.4.x ant\u00e9rieures \u00e0 20.4.1",
"product": {
"name": "SD-WAN vManage",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Immunet versions ant\u00e9rieures \u00e0 7.4.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco AMP for Endpoints pour Windows versions ant\u00e9rieures \u00e0 7.3.15",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Unity Connection versions ant\u00e9rieures \u00e0 11.5(1)SU9",
"product": {
"name": "Unity Connection",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "les routeurs Cisco Small Business RV132W versions ant\u00e9rieures \u00e0 1.0.1.15",
"product": {
"name": "Small Business",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Unity Connection versions 12.0.x et 12.5.x ant\u00e9rieures \u00e0 12.5(1)SU4",
"product": {
"name": "Unity Connection",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "les routeurs Cisco Small Business RV160, RV160W, RV260, RV260P et RV260W versions ant\u00e9rieures \u00e0 1.0.01.03",
"product": {
"name": "Small Business",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Unified CM IM\u0026P versions 12.0.x et 12.5.x ant\u00e9rieures \u00e0 12.5(1)SU4",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Unified CM et Unified CM SME versions 12.0.x et 12.5.x ant\u00e9rieures \u00e0 12.5(1)SU4",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco SD-WAN vManage versions ant\u00e9rieures \u00e0 19.2.4",
"product": {
"name": "SD-WAN vManage",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Unified CM et Unified CM SME versions ant\u00e9rieures \u00e0 11.5(1)SU9",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "les routeurs Cisco Small Business RV340, RV340W, RV345 et RV345P versions ant\u00e9rieures \u00e0 1.0.03.21",
"product": {
"name": "Small Business",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Prime License Manager versions ant\u00e9rieures \u00e0 11.5(1)SU9",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2021-1473",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1473"
},
{
"name": "CVE-2021-1480",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1480"
},
{
"name": "CVE-2021-1479",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1479"
},
{
"name": "CVE-2021-1362",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1362"
},
{
"name": "CVE-2021-1309",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1309"
},
{
"name": "CVE-2021-1386",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1386"
},
{
"name": "CVE-2021-1472",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1472"
},
{
"name": "CVE-2021-1251",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1251"
},
{
"name": "CVE-2021-1459",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1459"
},
{
"name": "CVE-2021-1137",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1137"
},
{
"name": "CVE-2021-1308",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1308"
}
],
"links": [],
"reference": "CERTFR-2021-AVI-246",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2021-04-08T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Cisco.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance\net un contournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-amp-imm-dll-tu79hvkO du 07 avril 2021",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-amp-imm-dll-tu79hvkO"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-cucm-rce-pqVYwyb du 07 avril 2021",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-rce-pqVYwyb"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-sb-rv-bypass-inject-Rbhgvfdx du 07 avril 2021",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-rv-bypass-inject-Rbhgvfdx"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-vmanage-YuTVWqy du 07 avril 2021",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanage-YuTVWqy"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-rv-multi-lldp-u7e4chCe du 07 avril 2021",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-multi-lldp-u7e4chCe"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-rv-rce-q3rxHnvm du 07 avril 2021",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-rce-q3rxHnvm"
}
]
}
CERTFR-2021-AVI-030
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Cisco. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et une élévation de privilèges.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | N/A | Cisco CMX versions 10.6.x antérieures à 10.6.3 | ||
| Cisco | N/A | Cisco AnyConnect Secure Mobility Client pour Windows versions antérieures à 4.9.04043 | ||
| Cisco | Small Business | Les routeurs Cisco Small Business RV110W, RV130, RV130W et RV215W (ces produits sont en fin de vie et ne bénéficieront plus de mises à jour de la part de Cisco) |
References
| Title | Publication Time | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Cisco CMX versions 10.6.x ant\u00e9rieures \u00e0 10.6.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco AnyConnect Secure Mobility Client pour Windows versions ant\u00e9rieures \u00e0 4.9.04043",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Les routeurs Cisco Small Business RV110W, RV130, RV130W et RV215W (ces produits sont en fin de vie et ne b\u00e9n\u00e9ficieront plus de mises \u00e0 jour de la part de Cisco)",
"product": {
"name": "Small Business",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2021-1185",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1185"
},
{
"name": "CVE-2021-1183",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1183"
},
{
"name": "CVE-2021-1208",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1208"
},
{
"name": "CVE-2021-1146",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1146"
},
{
"name": "CVE-2021-1206",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1206"
},
{
"name": "CVE-2021-1187",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1187"
},
{
"name": "CVE-2021-1190",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1190"
},
{
"name": "CVE-2021-1213",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1213"
},
{
"name": "CVE-2021-1178",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1178"
},
{
"name": "CVE-2021-1147",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1147"
},
{
"name": "CVE-2021-1174",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1174"
},
{
"name": "CVE-2021-1204",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1204"
},
{
"name": "CVE-2021-1215",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1215"
},
{
"name": "CVE-2021-1205",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1205"
},
{
"name": "CVE-2021-1177",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1177"
},
{
"name": "CVE-2021-1207",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1207"
},
{
"name": "CVE-2021-1210",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1210"
},
{
"name": "CVE-2021-1209",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1209"
},
{
"name": "CVE-2021-1188",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1188"
},
{
"name": "CVE-2021-1189",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1189"
},
{
"name": "CVE-2021-1149",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1149"
},
{
"name": "CVE-2021-1194",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1194"
},
{
"name": "CVE-2021-1186",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1186"
},
{
"name": "CVE-2021-1172",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1172"
},
{
"name": "CVE-2021-1162",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1162"
},
{
"name": "CVE-2021-1360",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1360"
},
{
"name": "CVE-2021-1173",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1173"
},
{
"name": "CVE-2021-1195",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1195"
},
{
"name": "CVE-2021-1192",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1192"
},
{
"name": "CVE-2021-1193",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1193"
},
{
"name": "CVE-2021-1166",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1166"
},
{
"name": "CVE-2021-1237",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1237"
},
{
"name": "CVE-2021-1211",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1211"
},
{
"name": "CVE-2021-1201",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1201"
},
{
"name": "CVE-2021-1199",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1199"
},
{
"name": "CVE-2021-1307",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1307"
},
{
"name": "CVE-2021-1184",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1184"
},
{
"name": "CVE-2021-1179",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1179"
},
{
"name": "CVE-2021-1164",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1164"
},
{
"name": "CVE-2021-1200",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1200"
},
{
"name": "CVE-2021-1170",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1170"
},
{
"name": "CVE-2021-1167",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1167"
},
{
"name": "CVE-2021-1159",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1159"
},
{
"name": "CVE-2021-1180",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1180"
},
{
"name": "CVE-2021-1196",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1196"
},
{
"name": "CVE-2021-1150",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1150"
},
{
"name": "CVE-2021-1169",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1169"
},
{
"name": "CVE-2021-1165",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1165"
},
{
"name": "CVE-2021-1203",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1203"
},
{
"name": "CVE-2021-1182",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1182"
},
{
"name": "CVE-2021-1176",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1176"
},
{
"name": "CVE-2021-1217",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1217"
},
{
"name": "CVE-2021-1148",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1148"
},
{
"name": "CVE-2021-1163",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1163"
},
{
"name": "CVE-2021-1198",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1198"
},
{
"name": "CVE-2021-1171",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1171"
},
{
"name": "CVE-2021-1216",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1216"
},
{
"name": "CVE-2021-1161",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1161"
},
{
"name": "CVE-2021-1214",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1214"
},
{
"name": "CVE-2021-1202",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1202"
},
{
"name": "CVE-2021-1197",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1197"
},
{
"name": "CVE-2021-1175",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1175"
},
{
"name": "CVE-2021-1160",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1160"
},
{
"name": "CVE-2021-1144",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1144"
},
{
"name": "CVE-2021-1168",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1168"
},
{
"name": "CVE-2021-1191",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1191"
},
{
"name": "CVE-2021-1181",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1181"
},
{
"name": "CVE-2021-1212",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1212"
}
],
"links": [],
"reference": "CERTFR-2021-AVI-030",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2021-01-14T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Cisco.\nElles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code\narbitraire \u00e0 distance et une \u00e9l\u00e9vation de privil\u00e8ges.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-rv-command-inject-LBdQ2KRN du 13 janvier 2021",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-command-inject-LBdQ2KRN"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-rv-overflow-WUnUgv4U du 13 janvier 2021",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-overflow-WUnUgv4U"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-cmxpe-75Asy9k du 13 janvier 2021",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cmxpe-75Asy9k"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-anyconnect-dll-injec-pQnryXLf du 13 janvier 2021",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-dll-injec-pQnryXLf"
}
]
}
CERTFR-2020-AVI-404
Vulnerability from certfr_avis - Published: - Updated:
Une vulnérabilité a été découverte dans les commutateurs Cisco. Elle permet à un attaquant de provoquer un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | Small Business | Commutateurs gérés empilables Cisco série 500 Small Business (produit en fin de vie) | ||
| Cisco | Small Business | Commutateurs intelligents Cisco série 200 Small Business (produit en fin de vie) | ||
| Cisco | N/A | Commutateurs gérés empilables Cisco série 350X versions antérieures à 2.5.5.47 | ||
| Cisco | N/A | Commutateurs intelligents Cisco série 250 versions antérieures à 2.5.5.47 | ||
| Cisco | Small Business | Commutateurs gérés Cisco série 300 Small Business (produit en fin de vie) | ||
| Cisco | N/A | Commutateurs gérés empilables Cisco série 550X versions antérieures à 2.5.5.47 | ||
| Cisco | N/A | Commutateurs gérés Cisco série 350 versions antérieures à 2.5.5.47 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Commutateurs g\u00e9r\u00e9s empilables Cisco s\u00e9rie 500 Small Business (produit en fin de vie)",
"product": {
"name": "Small Business",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Commutateurs intelligents Cisco s\u00e9rie 200 Small Business (produit en fin de vie)",
"product": {
"name": "Small Business",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Commutateurs g\u00e9r\u00e9s empilables Cisco s\u00e9rie 350X versions ant\u00e9rieures \u00e0 2.5.5.47",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Commutateurs intelligents Cisco s\u00e9rie 250 versions ant\u00e9rieures \u00e0 2.5.5.47",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Commutateurs g\u00e9r\u00e9s Cisco s\u00e9rie 300 Small Business (produit en fin de vie)",
"product": {
"name": "Small Business",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Commutateurs g\u00e9r\u00e9s empilables Cisco s\u00e9rie 550X versions ant\u00e9rieures \u00e0 2.5.5.47",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Commutateurs g\u00e9r\u00e9s Cisco s\u00e9rie 350 versions ant\u00e9rieures \u00e0 2.5.5.47",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2020-3297",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3297"
}
],
"links": [],
"reference": "CERTFR-2020-AVI-404",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2020-07-02T00:00:00.000000"
},
{
"description": "Modification du titre car une seule vuln\u00e9rabilit\u00e9 fait l\u0027objet de cet avis.",
"revision_date": "2020-07-03T00:00:00.000000"
}
],
"risks": [
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans les commutateurs Cisco. Elle\npermet \u00e0 un attaquant de provoquer un contournement de la politique de\ns\u00e9curit\u00e9.\n",
"title": "Vuln\u00e9rabilit\u00e9 dans les commutateurs Cisco",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-sbswitch-session-JZAS5jnY du 01 juillet 2020",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sbswitch-session-JZAS5jnY"
}
]
}
CERTFR-2019-AVI-304
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Cisco. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | Unified Communications Manager | Cisco Unified Communications Manager versions 12.5(x) antérieures à 12.5(1)SU1 | ||
| Cisco | N/A | Cisco AsyncOS versions antérieures à 10.5.5-005 | ||
| Cisco | Jabber | Cisco Jabber pour Windows versions antérieures à 12.6(0) | ||
| Cisco | Unified Communications Manager | Cisco Unified Communications Manager versions 12.0(x) antérieures à 12.0(1)SU3 | ||
| Cisco | N/A | Cisco AsyncOS versions 11.7.x antérieures à 11.7.0-407 | ||
| Cisco | N/A | Cisco APIC versions antérieures à 4.1(2g) | ||
| Cisco | Small Business | Cisco Small Business 200, 300 et 500 Series Managed Switches versions antérieures à 1.4.10.6 | ||
| Cisco | N/A | Cisco Nexus 9000 Series ACI Mode Switch versions antérieures à 14.1(2g) | ||
| Cisco | Unified Communications Manager | Cisco Unified Communications Manager versions antérieures à 11.5 sans le correctif de sécurité ciscocm.V11-5-1-SU5-SU6_CSCvo70834_C0003-1.cop.sgn | ||
| Cisco | Unified Communications Manager | Cisco Unified Communications Manager versions antérieures à 10.5(2) sans le correctif de sécurité ciscocm.V10-5-2-SU7-SU8_CSCvo70834_C0003-1.cop.sgn | ||
| Cisco | N/A | Cisco Enterprise NFV Infrastructure Software (NFVIS) versions antérieures à 3.10.1 | ||
| Cisco | N/A | Cisco AsyncOS versions 11.5.x antérieures à 11.5.2-020 |
References
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Cisco Unified Communications Manager versions 12.5(x) ant\u00e9rieures \u00e0 12.5(1)SU1",
"product": {
"name": "Unified Communications Manager",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco AsyncOS versions ant\u00e9rieures \u00e0 10.5.5-005",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Jabber pour Windows versions ant\u00e9rieures \u00e0 12.6(0)",
"product": {
"name": "Jabber",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Unified Communications Manager versions 12.0(x) ant\u00e9rieures \u00e0 12.0(1)SU3",
"product": {
"name": "Unified Communications Manager",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco AsyncOS versions 11.7.x ant\u00e9rieures \u00e0 11.7.0-407",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco APIC versions ant\u00e9rieures \u00e0 4.1(2g)",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Small Business 200, 300 et 500 Series Managed Switches versions ant\u00e9rieures \u00e0 1.4.10.6",
"product": {
"name": "Small Business",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Nexus 9000 Series ACI Mode Switch versions ant\u00e9rieures \u00e0 14.1(2g)",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Unified Communications Manager versions ant\u00e9rieures \u00e0 11.5 sans le correctif de s\u00e9curit\u00e9 ciscocm.V11-5-1-SU5-SU6_CSCvo70834_C0003-1.cop.sgn",
"product": {
"name": "Unified Communications Manager",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Unified Communications Manager versions ant\u00e9rieures \u00e0 10.5(2) sans le correctif de s\u00e9curit\u00e9 ciscocm.V10-5-2-SU7-SU8_CSCvo70834_C0003-1.cop.sgn",
"product": {
"name": "Unified Communications Manager",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Enterprise NFV Infrastructure Software (NFVIS) versions ant\u00e9rieures \u00e0 3.10.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco AsyncOS versions 11.5.x ant\u00e9rieures \u00e0 11.5.2-020",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2019-1884",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1884"
},
{
"name": "CVE-2019-1891",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1891"
},
{
"name": "CVE-2019-1893",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1893"
},
{
"name": "CVE-2019-1855",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1855"
},
{
"name": "CVE-2019-1892",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1892"
},
{
"name": "CVE-2019-1894",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1894"
},
{
"name": "CVE-2019-1889",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1889"
},
{
"name": "CVE-2019-1887",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1887"
},
{
"name": "CVE-2019-1886",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1886"
},
{
"name": "CVE-2019-1890",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1890"
}
],
"links": [],
"reference": "CERTFR-2019-AVI-304",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2019-07-04T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Ex\u00e9cution de code arbitraire"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Cisco.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire, un d\u00e9ni de service \u00e0 distance et un\ncontournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190703-wsa-dos du 03 juillet 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-wsa-dos"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190703-cucm-dos du 03 juillet 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-cucm-dos"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190703-jabber-dll du 03 juillet 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-jabber-dll"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190703-nfvis-file-readwrite du 03 juillet 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-nfvis-file-readwrite"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190703-ccapic-restapi du 03 juillet 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-ccapic-restapi"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190703-sbss-dos du 03 juillet 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-sbss-dos"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190703-n9kaci-bypass du 03 juillet 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-n9kaci-bypass"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190703-sbss-memcorrupt du 03 juillet 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-sbss-memcorrupt"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190703-nfvis-commandinj du 03 juillet 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-nfvis-commandinj"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190703-asyncos-wsa du 03 juillet 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-asyncos-wsa"
}
]
}
CERTFR-2019-AVI-228
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Cisco. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | NX-OS | Cisco NX-OS versions antérieures à 6.2(10) sur Nexus 7000 et 7700 Series Switches | ||
| Cisco | NX-OS | Cisco NX-OS versions 14.1(x) antérieures à 14.1(1i) sur Nexus 9000 Series Fabric Switches Mode ACI | ||
| Cisco | N/A | Webex Network Recording Player versions antérieures à Version 2.8MR3 SecurityPatch2, 3.0MR2 SecurityPatch2 ou 4.0 sur Cisco Webex Meetings Server | ||
| Cisco | Small Business | Small Business Sx250, Sx350, Sx550 Series Switches versions antérieures à 2.5.0.78 | ||
| Cisco | N/A | Cisco PI Software versions antérieures à 3.4.1, 3.5 et 3.6 | ||
| Cisco | N/A | Cisco FXOS versions 2.4.x antérieures à 2.4.1.222 sur Firepower 4100 Series et Firepower 9300 Security Appliances | ||
| Cisco | IOS XR | Cisco IOS XR versions antérieures à 5.3.3 Service Pack 11 | ||
| Cisco | IOS XR | Cisco IOS XR versions 6.6.x antérieures à 6.6.12 | ||
| Cisco | NX-OS | Cisco NX-OS versions 7.0.x antérieures à 7.0(3)I7(2) sur Nexus 3500 Platform Switches | ||
| Cisco | NX-OS | Cisco NX-OS versions 7.0(3).x antérieures à 7.0(3)F3(1) sur Nexus 9500 R-Series Switching Platform | ||
| Cisco | IOS XR | Cisco IOS XR versions 6.4.x antérieures à 6.4.2 | ||
| Cisco | NX-OS | Cisco NX-OS versions antérieures à 14.0(2c) sur Nexus 9000 Series Fabric Switches Mode ACI | ||
| Cisco | Small Business | Small Business Sx200, Sx300, Sx500 et ESW2 Series Managed Switches versions antérieures à 1.4.10.6 | ||
| Cisco | N/A | Cisco FXOS versions antérieures à 2.2.2.91 sur Firepower 4100 Series et Firepower 9300 Security Appliances | ||
| Cisco | NX-OS | Cisco NX-OS versions antérieures à 6.2(11) sur MDS 9000 Series Multilayer Switches | ||
| Cisco | NX-OS | Cisco NX-OS versions antérieures à 7.1(5)N1(1b) sur Nexus 5500, 5600 et 6000 Series Switches | ||
| Cisco | NX-OS | Cisco NX-OS versions 7.0(3)I7(x) antérieures à 7.0(3)I7(2) sur Nexus 3000 Series Switches et Nexus 9000 Series Switches en Standalone NX-OS Mode | ||
| Cisco | N/A | Cisco FXOS versions 2.6.x antérieures à 2.6.1.131 sur Firepower 4100 Series et Firepower 9300 Security Appliances | ||
| Cisco | IOS XR | Cisco IOS XR versions 6.3.x antérieures à 6.3.3 | ||
| Cisco | N/A | EPN Manager versions antérieures à 3.0.1 | ||
| Cisco | NX-OS | Cisco NX-OS versions antérieures à 5.2(1)SM3(2.1) sur Nexus 1000V Switch for Microsoft Hyper-V | ||
| Cisco | NX-OS | Cisco NX-OS versions 7.3.x antérieures à 7.3(4)N1(1a) sur Nexus 5500, 5600 et 6000 Series Switches | ||
| Cisco | N/A | Webex Network Recording Player et Webex Player versions antérieures à Version 1.3.42 sur Cisco Webex Meetings Online | ||
| Cisco | IOS XR | Cisco IOS XR versions 6.1.x, 6.2.x et 6.5.x antérieures à 6.5.3 | ||
| Cisco | N/A | Cisco Video Surveillance Manager versions antérieures à 7.12.1 | ||
| Cisco | NX-OS | Cisco NX-OS versions 8.0.x antérieures à 8.1(1) sur Nexus 7000 et 7700 Series Switches | ||
| Cisco | NX-OS | Cisco NX-OS versions antérieures à 6.0(2)A8(4) sur Nexus 3500 Platform Switches | ||
| Cisco | NX-OS | Cisco NX-OS versions 8.1(x) antérieures à 8.1(1) sur MDS 9000 Series Multilayer Switches | ||
| Cisco | N/A | Cisco FXOS versions 2.3.x antérieures à 2.3.1.130 sur Firepower 4100 Series et Firepower 9300 Security Appliances | ||
| Cisco | N/A | Webex Network Recording Player et Webex Player versions antérieures à WBS39.2.205 sur Cisco Webex Business Suite sites | ||
| Cisco | NX-OS | Cisco NX-OS versions antérieures à 7.0(3)I4(8) sur Nexus 3000 Series Switches et Nexus 9000 Series Switches en Standalone NX-OS Mode | ||
| Cisco | NX-OS | Cisco NX-OS versions antérieures à 5.2(1)SV3(4.1a) sur Nexus 1000V Switch for VMware vSphere | ||
| Cisco | NX-OS | Cisco NX-OS versions 7.2.x antérieures à 7.2(0)D1(1) sur Nexus 7000 et 7700 Series Switches |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Cisco NX-OS versions ant\u00e9rieures \u00e0 6.2(10) sur Nexus 7000 et 7700 Series Switches",
"product": {
"name": "NX-OS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco NX-OS versions 14.1(x) ant\u00e9rieures \u00e0 14.1(1i) sur Nexus 9000 Series Fabric Switches Mode ACI",
"product": {
"name": "NX-OS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Webex Network Recording Player versions ant\u00e9rieures \u00e0 Version 2.8MR3 SecurityPatch2, 3.0MR2 SecurityPatch2 ou 4.0 sur Cisco Webex Meetings Server",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Small Business Sx250, Sx350, Sx550 Series Switches versions ant\u00e9rieures \u00e0 2.5.0.78",
"product": {
"name": "Small Business",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco PI Software versions ant\u00e9rieures \u00e0 3.4.1, 3.5 et 3.6",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco FXOS versions 2.4.x ant\u00e9rieures \u00e0 2.4.1.222 sur Firepower 4100 Series et Firepower 9300 Security Appliances",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR versions ant\u00e9rieures \u00e0 5.3.3 Service Pack 11",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR versions 6.6.x ant\u00e9rieures \u00e0 6.6.12",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco NX-OS versions 7.0.x ant\u00e9rieures \u00e0 7.0(3)I7(2) sur Nexus 3500 Platform Switches",
"product": {
"name": "NX-OS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco NX-OS versions 7.0(3).x ant\u00e9rieures \u00e0 7.0(3)F3(1) sur Nexus 9500 R-Series Switching Platform",
"product": {
"name": "NX-OS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR versions 6.4.x ant\u00e9rieures \u00e0 6.4.2",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco NX-OS versions ant\u00e9rieures \u00e0 14.0(2c) sur Nexus 9000 Series Fabric Switches Mode ACI",
"product": {
"name": "NX-OS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Small Business Sx200, Sx300, Sx500 et ESW2 Series Managed Switches versions ant\u00e9rieures \u00e0 1.4.10.6",
"product": {
"name": "Small Business",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco FXOS versions ant\u00e9rieures \u00e0 2.2.2.91 sur Firepower 4100 Series et Firepower 9300 Security Appliances",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco NX-OS versions ant\u00e9rieures \u00e0 6.2(11) sur MDS 9000 Series Multilayer Switches",
"product": {
"name": "NX-OS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco NX-OS versions ant\u00e9rieures \u00e0 7.1(5)N1(1b) sur Nexus 5500, 5600 et 6000 Series Switches",
"product": {
"name": "NX-OS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco NX-OS versions 7.0(3)I7(x) ant\u00e9rieures \u00e0 7.0(3)I7(2) sur Nexus 3000 Series Switches et Nexus 9000 Series Switches en Standalone NX-OS Mode",
"product": {
"name": "NX-OS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco FXOS versions 2.6.x ant\u00e9rieures \u00e0 2.6.1.131 sur Firepower 4100 Series et Firepower 9300 Security Appliances",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR versions 6.3.x ant\u00e9rieures \u00e0 6.3.3",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "EPN Manager versions ant\u00e9rieures \u00e0 3.0.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco NX-OS versions ant\u00e9rieures \u00e0 5.2(1)SM3(2.1) sur Nexus 1000V Switch for Microsoft Hyper-V",
"product": {
"name": "NX-OS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco NX-OS versions 7.3.x ant\u00e9rieures \u00e0 7.3(4)N1(1a) sur Nexus 5500, 5600 et 6000 Series Switches",
"product": {
"name": "NX-OS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Webex Network Recording Player et Webex Player versions ant\u00e9rieures \u00e0 Version 1.3.42 sur Cisco Webex Meetings Online",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR versions 6.1.x, 6.2.x et 6.5.x ant\u00e9rieures \u00e0 6.5.3",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Video Surveillance Manager versions ant\u00e9rieures \u00e0 7.12.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco NX-OS versions 8.0.x ant\u00e9rieures \u00e0 8.1(1) sur Nexus 7000 et 7700 Series Switches",
"product": {
"name": "NX-OS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco NX-OS versions ant\u00e9rieures \u00e0 6.0(2)A8(4) sur Nexus 3500 Platform Switches",
"product": {
"name": "NX-OS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco NX-OS versions 8.1(x) ant\u00e9rieures \u00e0 8.1(1) sur MDS 9000 Series Multilayer Switches",
"product": {
"name": "NX-OS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco FXOS versions 2.3.x ant\u00e9rieures \u00e0 2.3.1.130 sur Firepower 4100 Series et Firepower 9300 Security Appliances",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Webex Network Recording Player et Webex Player versions ant\u00e9rieures \u00e0 WBS39.2.205 sur Cisco Webex Business Suite sites",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco NX-OS versions ant\u00e9rieures \u00e0 7.0(3)I4(8) sur Nexus 3000 Series Switches et Nexus 9000 Series Switches en Standalone NX-OS Mode",
"product": {
"name": "NX-OS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco NX-OS versions ant\u00e9rieures \u00e0 5.2(1)SV3(4.1a) sur Nexus 1000V Switch for VMware vSphere",
"product": {
"name": "NX-OS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco NX-OS versions 7.2.x ant\u00e9rieures \u00e0 7.2(0)D1(1) sur Nexus 7000 et 7700 Series Switches",
"product": {
"name": "NX-OS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2019-1823",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1823"
},
{
"name": "CVE-2019-1717",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1717"
},
{
"name": "CVE-2019-1771",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1771"
},
{
"name": "CVE-2019-1821",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1821"
},
{
"name": "CVE-2019-1849",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1849"
},
{
"name": "CVE-2019-1806",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1806"
},
{
"name": "CVE-2019-1772",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1772"
},
{
"name": "CVE-2019-1846",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1846"
},
{
"name": "CVE-2019-1824",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1824"
},
{
"name": "CVE-2019-1825",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1825"
},
{
"name": "CVE-2019-1773",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1773"
},
{
"name": "CVE-2019-1822",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1822"
},
{
"name": "CVE-2019-1858",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1858"
}
],
"links": [],
"reference": "CERTFR-2019-AVI-228",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2019-05-16T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Cisco.\nElles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code\narbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0\nla confidentialit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
"vendor_advisories": [
{
"published_at": "2019-05-15",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190515-nxos-snmp-dos",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-snmp-dos"
},
{
"published_at": "2019-05-15",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190515-iosxr-evpn-dos",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-iosxr-evpn-dos"
},
{
"published_at": "2019-05-15",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190515-sb-snmpdos",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-sb-snmpdos"
},
{
"published_at": "2019-05-15",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190515-webex-player",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-webex-player"
},
{
"published_at": "2019-05-15",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190515-pi-rce",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-pi-rce"
},
{
"published_at": "2019-05-15",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190515-iosxr-mpls-dos",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-iosxr-mpls-dos"
},
{
"published_at": "2019-05-15",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190515-cvsm",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-cvsm"
},
{
"published_at": "2019-05-15",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190515-pi-sqlinject",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-pi-sqlinject"
}
]
}
CERTFR-2019-AVI-193
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Cisco. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | IP Phone | Cisco Wireless IP Phone 8821 et 8821-EX versions antérieures à 11.0(5) | ||
| Cisco | N/A | Cisco 250 Series Smart Switches, 350 Series et 350x Series Managed Switches et 550X Series Stackable Managed Switches versions antérieures à 2.5.0.78 | ||
| Cisco | N/A | Cisco AsyncOS versions 11.7.x antérieures à 11.7.0-406 | ||
| Cisco | N/A | Cisco ASA versions antérieures à 9.4.4.34 | ||
| Cisco | N/A | Cisco AsyncOS versions 10.1.x antérieures à 10.1.4-017 | ||
| Cisco | N/A | Cisco Firepower et FMC versions 6.3.x antérieures à 6.3.0.3 (sortie prévue pour la semaine du 6 mai 2019) | ||
| Cisco | Small Business | Cisco Small Business 200 Series Smart Switches et Small Business 300 Series et 500 Series Managed Switches versions antérieures à 1.4.10.6 | ||
| Cisco | N/A | Cisco ASA versions 9.10.x antérieures à 9.10.1.17 | ||
| Cisco | N/A | Cisco ASA versions 9.5.x et 9.6.x antérieures à 9.6.4.25 | ||
| Cisco | N/A | Cisco Nexus 9000 Series ACI Mode Switch versions antérieures à 14.1(1i) | ||
| Cisco | N/A | Cisco ASA versions 9.7.x et 9.8.x antérieures à 9.8.4 | ||
| Cisco | N/A | Cisco Firepower et FMC versions antérieures à 6.2.3.12 | ||
| Cisco | N/A | Cisco RV320 et RV325 Dual Gigabit WAN VPN Routers Firmware versions antérieures à 1.4.2.20 | ||
| Cisco | N/A | Cisco ASA versions 9.9.x antérieures à 9.9.2.50 | ||
| Cisco | IP Phone | Cisco IP Phone 7800 Series et 8800 Series versions antérieures à 12.5(1) | ||
| Cisco | N/A | Cisco Nexus 9000 Series Application Policy Infrastructure Controller (APIC) versions antérieures à 4.1(1i) | ||
| Cisco | N/A | Cisco AsyncOS versions 10.5.x antérieures à 10.5.4-018 | ||
| Cisco | N/A | Cisco AsyncOS versions 11.5.x antérieures à 11.5.2-020 |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Cisco Wireless IP Phone 8821 et 8821-EX versions ant\u00e9rieures \u00e0 11.0(5)",
"product": {
"name": "IP Phone",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco 250 Series Smart Switches, 350 Series et 350x Series Managed Switches et 550X Series Stackable Managed Switches versions ant\u00e9rieures \u00e0 2.5.0.78",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco AsyncOS versions 11.7.x ant\u00e9rieures \u00e0 11.7.0-406",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco ASA versions ant\u00e9rieures \u00e0 9.4.4.34",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco AsyncOS versions 10.1.x ant\u00e9rieures \u00e0 10.1.4-017",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Firepower et FMC versions 6.3.x ant\u00e9rieures \u00e0 6.3.0.3 (sortie pr\u00e9vue pour la semaine du 6 mai 2019)",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Small Business 200 Series Smart Switches et Small Business 300 Series et 500 Series Managed Switches versions ant\u00e9rieures \u00e0 1.4.10.6",
"product": {
"name": "Small Business",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco ASA versions 9.10.x ant\u00e9rieures \u00e0 9.10.1.17",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco ASA versions 9.5.x et 9.6.x ant\u00e9rieures \u00e0 9.6.4.25",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Nexus 9000 Series ACI Mode Switch versions ant\u00e9rieures \u00e0 14.1(1i)",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco ASA versions 9.7.x et 9.8.x ant\u00e9rieures \u00e0 9.8.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Firepower et FMC versions ant\u00e9rieures \u00e0 6.2.3.12",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco RV320 et RV325 Dual Gigabit WAN VPN Routers Firmware versions ant\u00e9rieures \u00e0 1.4.2.20",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco ASA versions 9.9.x ant\u00e9rieures \u00e0 9.9.2.50",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IP Phone 7800 Series et 8800 Series versions ant\u00e9rieures \u00e0 12.5(1)",
"product": {
"name": "IP Phone",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Nexus 9000 Series Application Policy Infrastructure Controller (APIC) versions ant\u00e9rieures \u00e0 4.1(1i)",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco AsyncOS versions 10.5.x ant\u00e9rieures \u00e0 10.5.4-018",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco AsyncOS versions 11.5.x ant\u00e9rieures \u00e0 11.5.2-020",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2019-1807",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1807"
},
{
"name": "CVE-2019-1635",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1635"
},
{
"name": "CVE-2019-1817",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1817"
},
{
"name": "CVE-2018-15462",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-15462"
},
{
"name": "CVE-2019-1859",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1859"
},
{
"name": "CVE-2019-1803",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1803"
},
{
"name": "CVE-2019-1816",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1816"
},
{
"name": "CVE-2019-1704",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1704"
},
{
"name": "CVE-2019-1708",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1708"
},
{
"name": "CVE-2019-1724",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1724"
},
{
"name": "CVE-2018-15388",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-15388"
},
{
"name": "CVE-2019-1714",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1714"
},
{
"name": "CVE-2019-1694",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1694"
},
{
"name": "CVE-2019-1693",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1693"
},
{
"name": "CVE-2019-1703",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1703"
},
{
"name": "CVE-2019-1713",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1713"
},
{
"name": "CVE-2019-1715",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1715"
},
{
"name": "CVE-2019-1804",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1804"
},
{
"name": "CVE-2019-1696",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1696"
},
{
"name": "CVE-2019-1706",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1706"
}
],
"links": [],
"reference": "CERTFR-2019-AVI-193",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2019-05-02T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Cisco.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance\net un contournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190501-asa-ftd-ike-dos du 01 mai 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-asa-ftd-ike-dos"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190501-asa-ipsec-dos du 01 mai 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-asa-ipsec-dos"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190501-wsa-dos du 01 mai 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-wsa-dos"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190501-frpwr-dos du 01 mai 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-frpwr-dos"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190501-wsa-privesc du 01 mai 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-wsa-privesc"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190501-sd-cpu-dos du 01 mai 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-sd-cpu-dos"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190501-frpwr-smb-snort du 01 mai 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-frpwr-smb-snort"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190501-firepower-dos du 01 mai 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-firepower-dos"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190501-udb-sm du 01 mai 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-udb-sm"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190501-sbr-hijack du 01 mai 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-sbr-hijack"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190501-phone-sip-xml-dos du 01 mai 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-phone-sip-xml-dos"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190501-asa-ftd-entropy du 01 mai 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-asa-ftd-entropy"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190501-asa-csrf du 01 mai 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-asa-csrf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190501-asa-frpwrtd-dos du 01 mai 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-asa-frpwrtd-dos"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190501-nexus9k-rpe du 01 mai 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-nexus9k-rpe"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190501-asa-ftd-dos du 01 mai 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-asa-ftd-dos"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190501-scbv du 01 mai 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-scbv"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190501-aci-insecure-fabric du 01 mai 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-aci-insecure-fabric"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190501-apic-priv-escalation du 01 mai 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-apic-priv-escalation"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190501-asaftd-saml-vpn du 01 mai 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-asaftd-saml-vpn"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190501-nexus9k-sshkey du 01 mai 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-nexus9k-sshkey"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190501-aci-hw-clock-util du 01 mai 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-aci-hw-clock-util"
}
]
}
CERTFR-2018-AVI-536
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Cisco. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un contournement de la politique de sécurité et une élévation de privilèges.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | Small Business | Cisco Small Business 500 Series Stackable Managed Switches | ||
| Cisco | N/A | Appareils Cisco Meraki MR | ||
| Cisco | N/A | Appareils Cisco Meraki Z1 et Z3 | ||
| Cisco | Meraki MX | Appareils Cisco Meraki MX (incluant les équipements physiques et l'équipement virtuel vMX100) | ||
| Cisco | N/A | Cisco Stealthwatch Enterprise versions 6.10.2 et antérieures | ||
| Cisco | N/A | Appareils Cisco Meraki MS | ||
| Cisco | N/A | Cisco 350 Series Managed Switches | ||
| Cisco | Small Business | Cisco Small Business 300 Series Managed Switches | ||
| Cisco | Small Business | Cisco Small Business 200 Series Smart Switches | ||
| Cisco | N/A | Cisco 550X Series Stackable Managed Switches | ||
| Cisco | N/A | Cisco 250 Series Smart Switches | ||
| Cisco | N/A | Cisco Unity Express toutes versions antérieures à 9.0.6 | ||
| Cisco | N/A | Cisco 350X Series Stackable Managed Switches |
References
| Title | Publication Time | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Cisco Small Business 500 Series Stackable Managed Switches",
"product": {
"name": "Small Business",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Appareils Cisco Meraki MR",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Appareils Cisco Meraki Z1 et Z3",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Appareils Cisco Meraki MX (incluant les \u00e9quipements physiques et l\u0027\u00e9quipement virtuel vMX100)",
"product": {
"name": "Meraki MX",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Stealthwatch Enterprise versions 6.10.2 et ant\u00e9rieures",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Appareils Cisco Meraki MS",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco 350 Series Managed Switches",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Small Business 300 Series Managed Switches",
"product": {
"name": "Small Business",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Small Business 200 Series Smart Switches",
"product": {
"name": "Small Business",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco 550X Series Stackable Managed Switches",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco 250 Series Smart Switches",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Unity Express toutes versions ant\u00e9rieures \u00e0 9.0.6",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco 350X Series Stackable Managed Switches",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2018-15381",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-15381"
},
{
"name": "CVE-2018-15394",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-15394"
},
{
"name": "CVE-2018-15439",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-15439"
},
{
"name": "CVE-2018-0284",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-0284"
}
],
"links": [],
"reference": "CERTFR-2018-AVI-536",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2018-11-08T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Cisco.\nElles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code\narbitraire \u00e0 distance, un contournement de la politique de s\u00e9curit\u00e9 et\nune \u00e9l\u00e9vation de privil\u00e8ges.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20181107-smc-auth-bypass du 7 novembre 2018",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-smc-auth-bypass"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20181107-sbsw-privacc du 7 novembre 2018",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-sbsw-privacc"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20181107-meraki du 7 novembre 2018",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-meraki"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20181107-cue du 7 novembre 2018",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-cue"
}
]
}
CERTFR-2017-AVI-372
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Cisco. Elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à l'intégrité des données et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | N/A | Nexus 9500 R-Series Line Cards et Fabric Modules | ||
| Cisco | N/A | Nexus 5500 Platform Switches | ||
| Cisco | N/A | Firepower 9300 Security Appliance | ||
| Cisco | N/A | UCS 6200 Series Fabric Interconnects | ||
| Cisco | N/A | Nexus 6000 Series Switches | ||
| Cisco | N/A | Nexus 7000 Series Switches | ||
| Cisco | N/A | Nexus 1100 Series Cloud Services Platforms | ||
| Cisco | Small Business | Cisco Small Business SPA50x, SPA51x, et SPA52x Series IP Phones avec une version du micrologiciel 7.6.2SR1 ou antérieure | ||
| Cisco | N/A | Nexus 7700 Series Switches | ||
| Cisco | N/A | UCS 6300 Series Fabric Interconnects | ||
| Cisco | N/A | Nexus 3500 Platform Switches | ||
| Cisco | N/A | Nexus 5600 Platform Switches | ||
| Cisco | N/A | Nexus 1000V Series Switches | ||
| Cisco | N/A | Multilayer Director Switches | ||
| Cisco | N/A | Unified Computing System (UCS) 6100 Series Fabric Interconnects | ||
| Cisco | NX-OS | Nexus 9000 Series Switches en mode NX-OS | ||
| Cisco | N/A | Cisco Cloud Services Platform (CSP) 2100 avec une version logicielle 2.1.0, 2.1.1, 2.1.2, 2.2.0, 2.2.1 ou 2.2.2 | ||
| Cisco | N/A | Nexus 5000 Series Switches | ||
| Cisco | N/A | Nexus 3000 Series Switches | ||
| Cisco | N/A | Firepower 4100 Series Next-Generation Firewall | ||
| Cisco | N/A | Nexus 2000 Series Switches |
References
| Title | Publication Time | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Nexus 9500 R-Series Line Cards et Fabric Modules",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Nexus 5500 Platform Switches",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Firepower 9300 Security Appliance",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "UCS 6200 Series Fabric Interconnects",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Nexus 6000 Series Switches",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Nexus 7000 Series Switches",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Nexus 1100 Series Cloud Services Platforms",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Small Business SPA50x, SPA51x, et SPA52x Series IP Phones avec une version du micrologiciel 7.6.2SR1 ou ant\u00e9rieure",
"product": {
"name": "Small Business",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Nexus 7700 Series Switches",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "UCS 6300 Series Fabric Interconnects",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Nexus 3500 Platform Switches",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Nexus 5600 Platform Switches",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Nexus 1000V Series Switches",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Multilayer Director Switches",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Unified Computing System (UCS) 6100 Series Fabric Interconnects",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Nexus 9000 Series Switches en mode NX-OS",
"product": {
"name": "NX-OS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Cloud Services Platform (CSP) 2100 avec une version logicielle 2.1.0, 2.1.1, 2.1.2, 2.2.0, 2.2.1 ou 2.2.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Nexus 5000 Series Switches",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Nexus 3000 Series Switches",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Firepower 4100 Series Next-Generation Firewall",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Nexus 2000 Series Switches",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2017-12259",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-12259"
},
{
"name": "CVE-2017-12260",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-12260"
},
{
"name": "CVE-2017-12251",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-12251"
},
{
"name": "CVE-2017-3883",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-3883"
}
],
"links": [],
"reference": "CERTFR-2017-AVI-372",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2017-10-19T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Cisco.\nElles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0\ndistance, une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es et une atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20171018-ccs du 18 octobre 2017",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-ccs"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20171018-sip1 du 18 octobre 2017",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-sip1"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20171018-sip du 18 octobre 2017",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-sip"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20171018-aaavty du 18 octobre 2017",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-aaavty"
}
]
}
CERTFR-2017-AVI-317
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été corrigées dans les produits Cisco. Elles permettent à un attaquant de provoquer un déni de service à distance et une élévation de privilèges.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | N/A | 350X Series Stackable Managed Switches versions antérieures à 2.3.0.130 | ||
| Cisco | N/A | 350 Series Managed Switches versions antérieures à 2.3.0.130 | ||
| Cisco | N/A | 550X Series Stackable Managed Switches versions antérieures à 2.3.0.130 | ||
| Cisco | Small Business | Small Business 300 Series Managed Switches versions antérieures à 1.4.8.06 | ||
| Cisco | N/A | Cisco AsyncOS pour Cisco Email Security Appliances sans le dernier correctif de sécurité | ||
| Cisco | N/A | ESW2 Series Advanced Switches versions antérieures à 1.4.8.06 | ||
| Cisco | Small Business | Small Business 500 Series Stackable Managed Switches versions antérieures à 1.4.8.06 | ||
| Cisco | N/A | Cisco Unified Customer Voice Portal (CVP) versions 10.5, 11.0 et 11.5 |
References
| Title | Publication Time | Tags | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "350X Series Stackable Managed Switches versions ant\u00e9rieures \u00e0 2.3.0.130",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "350 Series Managed Switches versions ant\u00e9rieures \u00e0 2.3.0.130",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "550X Series Stackable Managed Switches versions ant\u00e9rieures \u00e0 2.3.0.130",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Small Business 300 Series Managed Switches versions ant\u00e9rieures \u00e0 1.4.8.06",
"product": {
"name": "Small Business",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco AsyncOS pour Cisco Email Security Appliances sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "ESW2 Series Advanced Switches versions ant\u00e9rieures \u00e0 1.4.8.06",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Small Business 500 Series Stackable Managed Switches versions ant\u00e9rieures \u00e0 1.4.8.06",
"product": {
"name": "Small Business",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Unified Customer Voice Portal (CVP) versions 10.5, 11.0 et 11.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2017-6720",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-6720"
},
{
"name": "CVE-2017-12215",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-12215"
},
{
"name": "CVE-2017-12214",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-12214"
}
],
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20170920-cvp du 20 septembre 2017",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170920-cvp"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20170920-esa du 20 septembre 2017",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170920-esa"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20170920-sbms du 20 septembre 2017",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170920-sbms"
}
],
"reference": "CERTFR-2017-AVI-317",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2017-09-21T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eles produits Cisco\u003c/span\u003e. Elles permettent \u00e0 un\nattaquant de provoquer un d\u00e9ni de service \u00e0 distance et une \u00e9l\u00e9vation de\nprivil\u00e8ges.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20170920-esa du 20 septembre 2017",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20170920-sbms du 20 septembre 2017",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20170920-cvp du 20 septembre 2017",
"url": null
}
]
}
CERTFR-2016-AVI-291
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été corrigées dans les produits Cisco. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | N/A | Cisco Wireless LAN Controller versions antérieures à 8.0.140.0 | ||
| Cisco | N/A | Cisco WebEx Meetings Player versions antérieures à T29.10 | ||
| Cisco | Small Business | SPA500 Series IP Phones utilisant une version de Cisco Small Business IP Phones inférieure à 7.5.7(6) | ||
| Cisco | N/A | Cisco Virtual Media Packager (VMP) utilisant Media Origination System versions antérieures à 2.6 | ||
| Cisco | Small Business | SPA51x IP Phones utilisant une version de Cisco Small Business IP Phones inférieure à 7.5.7(6) | ||
| Cisco | Small Business | SPA300 Series IP Phones utilisant une version de Cisco Small Business IP Phones inférieure à 7.5.7(6) | ||
| Cisco | N/A | Cisco Hosted Collaboration Mediation Fulfillment (HCM-F) versions antérieures à 10.6(3) | ||
| Cisco | Small Business | Cisco Small Business 220 Series Smart Plus (Sx220) Switches versions 1.0.0.17, 1.0.0.18, ou 1.0.0.19 et qui ont la fonctionnalité SNMP activée |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Cisco Wireless LAN Controller versions ant\u00e9rieures \u00e0 8.0.140.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco WebEx Meetings Player versions ant\u00e9rieures \u00e0 T29.10",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "SPA500 Series IP Phones utilisant une version de Cisco Small Business IP Phones inf\u00e9rieure \u00e0 7.5.7(6)",
"product": {
"name": "Small Business",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Virtual Media Packager (VMP) utilisant Media Origination System versions ant\u00e9rieures \u00e0 2.6",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "SPA51x IP Phones utilisant une version de Cisco Small Business IP Phones inf\u00e9rieure \u00e0 7.5.7(6)",
"product": {
"name": "Small Business",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "SPA300 Series IP Phones utilisant une version de Cisco Small Business IP Phones inf\u00e9rieure \u00e0 7.5.7(6)",
"product": {
"name": "Small Business",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Hosted Collaboration Mediation Fulfillment (HCM-F) versions ant\u00e9rieures \u00e0 10.6(3)",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Small Business 220 Series Smart Plus (Sx220) Switches versions 1.0.0.17, 1.0.0.18, ou 1.0.0.19 et qui ont la fonctionnalit\u00e9 SNMP activ\u00e9e",
"product": {
"name": "Small Business",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [],
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160831-wlc-2 du 31 ao\u00fbt 2016",
"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160831-wlc-2"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160831-meetings-player du 31 ao\u00fbt 2016",
"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160831-meetings-player"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160831-sps du 31 ao\u00fbt 2016",
"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160831-sps"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160831-hcmf du 31 ao\u00fbt 2016",
"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160831-hcmf"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160831-sps2 du 31 ao\u00fbt 2016",
"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160831-sps2"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160831-sps1 du 31 ao\u00fbt 2016",
"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160831-sps1"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160831-webex du 31 ao\u00fbt 2016",
"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160831-webex"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160831-vmp du 31 ao\u00fbt 2016",
"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160831-vmp"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160831-wlc-1 du 31 ao\u00fbt 2016",
"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160831-wlc-1"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160831-spa du 31 ao\u00fbt 2016",
"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160831-spa"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160831-hcm du 31 ao\u00fbt 2016",
"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160831-hcm"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160831-sps3 du 31 ao\u00fbt 2016",
"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160831-sps3"
}
],
"reference": "CERTFR-2016-AVI-291",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2016-09-02T00:00:00.000000"
}
],
"risks": [
{
"description": "Injection de code indirecte \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eles produits Cisco\u003c/span\u003e. Certaines d\u0027entre elles\npermettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire\n\u00e0 distance, un d\u00e9ni de service \u00e0 distance et un contournement de la\npolitique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160831-spa du 31 ao\u00fbt 2016",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160831-meetings-player du 31 ao\u00fbt 2016",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160831-hcmf du 31 ao\u00fbt 2016",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160831-hcm du 31 ao\u00fbt 2016",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160831-webex du 31 ao\u00fbt 2016",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160831-wlc-2 du 31 ao\u00fbt 2016",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160831-sps2 du 31 ao\u00fbt 2016",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160831-sps1 du 31 ao\u00fbt 2016",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160831-sps3 du 31 ao\u00fbt 2016",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160831-sps du 31 ao\u00fbt 2016",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160831-wlc-1 du 31 ao\u00fbt 2016",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160831-vmp du 31 ao\u00fbt 2016",
"url": null
}
]
}
CERTFR-2016-AVI-065
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été corrigées dans les produits Cisco. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, un contournement de la politique de sécurité et une atteinte à l'intégrité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | N/A | Cisco Universal Small Cell devices | ||
| Cisco | N/A | Cisco Emergency Responder version 11.5(0.99833.5) | ||
| Cisco | IOS | Cisco Industrial Ethernet 2000 Series Switches exécutant Cisco IOS version 15.2(4)E | ||
| Cisco | Small Business | Cisco Small Business 500 Series Wireless Access Point version 1.0.4.4 | ||
| Cisco | N/A | Cisco AMP exécutant Cisco ESA versions 9.5.0-201, 9.6.0-051, et 9.7.0-125 | ||
| Cisco | N/A | Cisco 1000 Series Connected Grid Router si la fonctionnalité SNMP est configurée |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Cisco Universal Small Cell devices",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Emergency Responder version 11.5(0.99833.5)",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Industrial Ethernet 2000 Series Switches ex\u00e9cutant Cisco IOS version 15.2(4)E",
"product": {
"name": "IOS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Small Business 500 Series Wireless Access Point version 1.0.4.4",
"product": {
"name": "Small Business",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco AMP ex\u00e9cutant Cisco ESA versions 9.5.0-201, 9.6.0-051, et 9.7.0-125",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco 1000 Series Connected Grid Router si la fonctionnalit\u00e9 SNMP est configur\u00e9e",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2016-1331",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-1331"
},
{
"name": "CVE-2016-1321",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-1321"
},
{
"name": "CVE-2016-1315",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-1315"
},
{
"name": "CVE-2016-1330",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-1330"
},
{
"name": "CVE-2016-1334",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-1334"
},
{
"name": "CVE-2016-1333",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-1333"
}
],
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160215-er du 15 f\u00e9vrier 2016",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160215-er"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160216-grid du 16 f\u00e9vrier 2016",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160216-grid"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160215-ie2000 du 15 f\u00e9vrier 2016",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160215-ie2000"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160216-wap du 16 f\u00e9vrier 2016",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160216-wap"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160212-usc du 12 f\u00e9vrier 2016",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160212-usc"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160211-esaamp du 11 f\u00e9vrier 2016",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160211-esaamp"
}
],
"reference": "CERTFR-2016-AVI-065",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2016-02-17T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Injection de code indirecte \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eles produits Cisco\u003c/span\u003e. Certaines d\u0027entre elles\npermettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance, un\ncontournement de la politique de s\u00e9curit\u00e9 et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9\ndes donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160216-wap du 16 f\u00e9vrier 2016",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160211-esaamp du 11 f\u00e9vrier 2016",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160216-grid du 16 f\u00e9vrier 2016",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160212-usc du 12 f\u00e9vrier 2016",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160215-ie2000 du 15 f\u00e9vrier 2016",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160215-er du 15 f\u00e9vrier 2016",
"url": null
}
]
}