All the vulnerabilites related to cisco - adaptive_security_appliance_device_manager
cve-2007-0397
Vulnerability from cvelistv5
Published
2007-01-20 01:00
Modified
2024-08-07 12:19
Severity ?
EPSS score ?
Summary
The Cisco Security Monitoring, Analysis and Response System (CS-MARS) before 4.2.3 and Adaptive Security Device Manager (ASDM) before 5.2(2.54) do not validate the SSL/TLS certificates or SSH public keys when connecting to devices, which allows remote attackers to spoof those devices to obtain sensitive information or generate incorrect information.
References
| ▼ | URL | Tags |
|---|---|---|
| http://securitytracker.com/id?1017535 | vdb-entry, x_refsource_SECTRACK | |
| http://www.securityfocus.com/bid/22111 | vdb-entry, x_refsource_BID | |
| http://osvdb.org/32720 | vdb-entry, x_refsource_OSVDB | |
| http://www.vupen.com/english/advisories/2007/0245 | vdb-entry, x_refsource_VUPEN | |
| http://securitytracker.com/id?1017536 | vdb-entry, x_refsource_SECTRACK | |
| http://secunia.com/advisories/23836 | third-party-advisory, x_refsource_SECUNIA | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/31567 | vdb-entry, x_refsource_XF | |
| http://www.cisco.com/en/US/products/products_security_advisory09186a00807c517f.shtml | vendor-advisory, x_refsource_CISCO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T12:19:29.755Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1017535",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1017535"
},
{
"name": "22111",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/22111"
},
{
"name": "32720",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/32720"
},
{
"name": "ADV-2007-0245",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/0245"
},
{
"name": "1017536",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1017536"
},
{
"name": "23836",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/23836"
},
{
"name": "cisco-csmars-asdm-device-spoofing(31567)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31567"
},
{
"name": "20070118 SSL/TLS Certificate and SSH Public Key Validation Vulnerability",
"tags": [
"vendor-advisory",
"x_refsource_CISCO",
"x_transferred"
],
"url": "http://www.cisco.com/en/US/products/products_security_advisory09186a00807c517f.shtml"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-01-18T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The Cisco Security Monitoring, Analysis and Response System (CS-MARS) before 4.2.3 and Adaptive Security Device Manager (ASDM) before 5.2(2.54) do not validate the SSL/TLS certificates or SSH public keys when connecting to devices, which allows remote attackers to spoof those devices to obtain sensitive information or generate incorrect information."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "1017535",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1017535"
},
{
"name": "22111",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/22111"
},
{
"name": "32720",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/32720"
},
{
"name": "ADV-2007-0245",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/0245"
},
{
"name": "1017536",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1017536"
},
{
"name": "23836",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/23836"
},
{
"name": "cisco-csmars-asdm-device-spoofing(31567)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31567"
},
{
"name": "20070118 SSL/TLS Certificate and SSH Public Key Validation Vulnerability",
"tags": [
"vendor-advisory",
"x_refsource_CISCO"
],
"url": "http://www.cisco.com/en/US/products/products_security_advisory09186a00807c517f.shtml"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-0397",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Cisco Security Monitoring, Analysis and Response System (CS-MARS) before 4.2.3 and Adaptive Security Device Manager (ASDM) before 5.2(2.54) do not validate the SSL/TLS certificates or SSH public keys when connecting to devices, which allows remote attackers to spoof those devices to obtain sensitive information or generate incorrect information."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1017535",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1017535"
},
{
"name": "22111",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/22111"
},
{
"name": "32720",
"refsource": "OSVDB",
"url": "http://osvdb.org/32720"
},
{
"name": "ADV-2007-0245",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/0245"
},
{
"name": "1017536",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1017536"
},
{
"name": "23836",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/23836"
},
{
"name": "cisco-csmars-asdm-device-spoofing(31567)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31567"
},
{
"name": "20070118 SSL/TLS Certificate and SSH Public Key Validation Vulnerability",
"refsource": "CISCO",
"url": "http://www.cisco.com/en/US/products/products_security_advisory09186a00807c517f.shtml"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-0397",
"datePublished": "2007-01-20T01:00:00",
"dateReserved": "2007-01-19T00:00:00",
"dateUpdated": "2024-08-07T12:19:29.755Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2019-1715
Vulnerability from cvelistv5
Published
2019-05-03 16:20
Modified
2024-11-19 19:08
Severity ?
EPSS score ?
Summary
A vulnerability in the Deterministic Random Bit Generator (DRBG), also known as Pseudorandom Number Generator (PRNG), used in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a cryptographic collision, enabling the attacker to discover the private key of an affected device. The vulnerability is due to insufficient entropy in the DRBG when generating cryptographic keys. An attacker could exploit this vulnerability by generating a large number of cryptographic keys on an affected device and looking for collisions with target devices. A successful exploit could allow the attacker to impersonate an affected target device or to decrypt traffic secured by an affected key that is sent to or from an affected target device.
References
| ▼ | URL | Tags |
|---|---|---|
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-asa-ftd-entropy | vendor-advisory, x_refsource_CISCO |
Impacted products
| Vendor | Product | Version | |||||
|---|---|---|---|---|---|---|---|
| ▼ | Cisco | Cisco Adaptive Security Appliance (ASA) Software |
Version: unspecified < 9.8.4 Version: unspecified < 9.9.2.50 |
||||
|
|||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T18:28:42.279Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20190501 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Low-Entropy Keys Vulnerability",
"tags": [
"vendor-advisory",
"x_refsource_CISCO",
"x_transferred"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-asa-ftd-entropy"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2019-1715",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-19T17:24:18.472065Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-19T19:08:18.850Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Cisco Adaptive Security Appliance (ASA) Software",
"vendor": "Cisco",
"versions": [
{
"lessThan": "9.8.4",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThan": "9.9.2.50",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Cisco Firepower Threat Defense (FTD) Software",
"vendor": "Cisco",
"versions": [
{
"lessThan": "6.2.3.12",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
},
{
"lessThan": "6.3.0.3",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"datePublic": "2019-05-01T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the Deterministic Random Bit Generator (DRBG), also known as Pseudorandom Number Generator (PRNG), used in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a cryptographic collision, enabling the attacker to discover the private key of an affected device. The vulnerability is due to insufficient entropy in the DRBG when generating cryptographic keys. An attacker could exploit this vulnerability by generating a large number of cryptographic keys on an affected device and looking for collisions with target devices. A successful exploit could allow the attacker to impersonate an affected target device or to decrypt traffic secured by an affected key that is sent to or from an affected target device."
}
],
"exploits": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-332",
"description": "CWE-332",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-05-03T16:20:30",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "20190501 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Low-Entropy Keys Vulnerability",
"tags": [
"vendor-advisory",
"x_refsource_CISCO"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-asa-ftd-entropy"
}
],
"source": {
"advisory": "cisco-sa-20190501-asa-ftd-entropy",
"defect": [
[
"CSCvj52266"
]
],
"discovery": "INTERNAL"
},
"title": "Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Low-Entropy Keys Vulnerability",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@cisco.com",
"DATE_PUBLIC": "2019-05-01T16:00:00-0700",
"ID": "CVE-2019-1715",
"STATE": "PUBLIC",
"TITLE": "Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Low-Entropy Keys Vulnerability"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Cisco Adaptive Security Appliance (ASA) Software",
"version": {
"version_data": [
{
"affected": "\u003c",
"version_affected": "\u003c",
"version_value": "9.8.4"
},
{
"affected": "\u003c",
"version_affected": "\u003c",
"version_value": "9.9.2.50"
}
]
}
},
{
"product_name": "Cisco Firepower Threat Defense (FTD) Software",
"version": {
"version_data": [
{
"affected": "\u003c",
"version_affected": "\u003c",
"version_value": "6.2.3.12"
},
{
"affected": "\u003c",
"version_affected": "\u003c",
"version_value": "6.3.0.3"
}
]
}
}
]
},
"vendor_name": "Cisco"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability in the Deterministic Random Bit Generator (DRBG), also known as Pseudorandom Number Generator (PRNG), used in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a cryptographic collision, enabling the attacker to discover the private key of an affected device. The vulnerability is due to insufficient entropy in the DRBG when generating cryptographic keys. An attacker could exploit this vulnerability by generating a large number of cryptographic keys on an affected device and looking for collisions with target devices. A successful exploit could allow the attacker to impersonate an affected target device or to decrypt traffic secured by an affected key that is sent to or from an affected target device."
}
]
},
"exploit": [
{
"lang": "en",
"value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
}
],
"impact": {
"cvss": {
"baseScore": "5.3",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-332"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20190501 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Low-Entropy Keys Vulnerability",
"refsource": "CISCO",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-asa-ftd-entropy"
}
]
},
"source": {
"advisory": "cisco-sa-20190501-asa-ftd-entropy",
"defect": [
[
"CSCvj52266"
]
],
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2019-1715",
"datePublished": "2019-05-03T16:20:30.170634Z",
"dateReserved": "2018-12-06T00:00:00",
"dateUpdated": "2024-11-19T19:08:18.850Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2013-1192
Vulnerability from cvelistv5
Published
2013-04-25 10:00
Modified
2024-09-16 20:22
Severity ?
EPSS score ?
Summary
The JAR files on Cisco Device Manager for Cisco MDS 9000 devices before 5.2.8, and Cisco Device Manager for Cisco Nexus 5000 devices, allow remote attackers to execute arbitrary commands on Windows client machines via a crafted element-manager.jnlp file, aka Bug IDs CSCty17417 and CSCty10802.
References
| ▼ | URL | Tags |
|---|---|---|
| http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130424-fmdm | vendor-advisory, x_refsource_CISCO |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T14:57:03.530Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20130424 Cisco Device Manager Command Execution Vulnerability",
"tags": [
"vendor-advisory",
"x_refsource_CISCO",
"x_transferred"
],
"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130424-fmdm"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The JAR files on Cisco Device Manager for Cisco MDS 9000 devices before 5.2.8, and Cisco Device Manager for Cisco Nexus 5000 devices, allow remote attackers to execute arbitrary commands on Windows client machines via a crafted element-manager.jnlp file, aka Bug IDs CSCty17417 and CSCty10802."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-04-25T10:00:00Z",
"orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"shortName": "cisco"
},
"references": [
{
"name": "20130424 Cisco Device Manager Command Execution Vulnerability",
"tags": [
"vendor-advisory",
"x_refsource_CISCO"
],
"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130424-fmdm"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@cisco.com",
"ID": "CVE-2013-1192",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The JAR files on Cisco Device Manager for Cisco MDS 9000 devices before 5.2.8, and Cisco Device Manager for Cisco Nexus 5000 devices, allow remote attackers to execute arbitrary commands on Windows client machines via a crafted element-manager.jnlp file, aka Bug IDs CSCty17417 and CSCty10802."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20130424 Cisco Device Manager Command Execution Vulnerability",
"refsource": "CISCO",
"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130424-fmdm"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
"assignerShortName": "cisco",
"cveId": "CVE-2013-1192",
"datePublished": "2013-04-25T10:00:00Z",
"dateReserved": "2013-01-11T00:00:00Z",
"dateUpdated": "2024-09-16T20:22:27.150Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Vulnerability from fkie_nvd
Published
2007-01-20 01:28
Modified
2024-11-21 00:25
Severity ?
Summary
The Cisco Security Monitoring, Analysis and Response System (CS-MARS) before 4.2.3 and Adaptive Security Device Manager (ASDM) before 5.2(2.54) do not validate the SSL/TLS certificates or SSH public keys when connecting to devices, which allows remote attackers to spoof those devices to obtain sensitive information or generate incorrect information.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cisco | security_monitoring_analysis_and_response_system | 4.2.3 | |
| cisco | adaptive_security_appliance_device_manager | 5.2.53 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:security_monitoring_analysis_and_response_system:4.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "7B60CEE1-D3EE-4C03-B47A-06E26BA08A3F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:adaptive_security_appliance_device_manager:5.2.53:*:*:*:*:*:*:*",
"matchCriteriaId": "378FF1D6-86D3-431C-927F-16FF6372529A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Cisco Security Monitoring, Analysis and Response System (CS-MARS) before 4.2.3 and Adaptive Security Device Manager (ASDM) before 5.2(2.54) do not validate the SSL/TLS certificates or SSH public keys when connecting to devices, which allows remote attackers to spoof those devices to obtain sensitive information or generate incorrect information."
},
{
"lang": "es",
"value": "El Cisco Security Monitoring, Analysis y Response System (CS-MARS) anterior 4.2.3 y Adaptive Security Device Manager (ASDM) anterior 5.2(2.54) no valida los certificados SSL/TLS o llaves p\u00fablicas SSH cuando se conectan dispositivos, lo cual permite a atacantes remotos suplantar a estos dispositivos obteniendo informaci\u00f3n sensible o generando informaci\u00f3n incorrecta."
}
],
"id": "CVE-2007-0397",
"lastModified": "2024-11-21T00:25:45.683",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-01-20T01:28:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/32720"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/23836"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1017535"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1017536"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.cisco.com/en/US/products/products_security_advisory09186a00807c517f.shtml"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/22111"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/0245"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31567"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/32720"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/23836"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1017535"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1017536"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.cisco.com/en/US/products/products_security_advisory09186a00807c517f.shtml"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/22111"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/0245"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31567"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-05-03 17:29
Modified
2024-11-21 04:37
Severity ?
5.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
7.5 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
7.5 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
A vulnerability in the Deterministic Random Bit Generator (DRBG), also known as Pseudorandom Number Generator (PRNG), used in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a cryptographic collision, enabling the attacker to discover the private key of an affected device. The vulnerability is due to insufficient entropy in the DRBG when generating cryptographic keys. An attacker could exploit this vulnerability by generating a large number of cryptographic keys on an affected device and looking for collisions with target devices. A successful exploit could allow the attacker to impersonate an affected target device or to decrypt traffic secured by an affected key that is sent to or from an affected target device.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| cisco | adaptive_security_appliance_device_manager | * | |
| cisco | adaptive_security_appliance_device_manager | * | |
| cisco | firepower_threat_defense | * | |
| cisco | firepower_threat_defense | * | |
| cisco | asa-5506-x | - | |
| cisco | asa-5506h-x | - | |
| cisco | asa-5506w-x | - | |
| cisco | asa-5508-x | - | |
| cisco | asa-5516-x | - | |
| cisco | asa-5525-x | - | |
| cisco | asa-5545-x | - | |
| cisco | asa-5555-x | - | |
| cisco | asa_5500 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:adaptive_security_appliance_device_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0F79CB60-BED5-4750-B503-DA7C860B2DE8",
"versionEndExcluding": "9.8.4",
"versionStartIncluding": "9.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:adaptive_security_appliance_device_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "62D8BB1B-1B4E-44F5-B59A-927C29711992",
"versionEndExcluding": "9.9.2.50",
"versionStartIncluding": "9.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C8F292C5-67ED-4F18-B6C4-5873BB771C3D",
"versionEndExcluding": "6.2.3.12",
"versionStartIncluding": "6.2.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9A16803C-579C-4992-B37E-7CEC17307659",
"versionEndExcluding": "6.3.0.3",
"versionStartIncluding": "6.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:asa-5506-x:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4916B846-AEAD-4C06-9705-048627F27236",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asa-5506h-x:-:*:*:*:*:*:*:*",
"matchCriteriaId": "931B9C8E-6AD7-4E05-8E48-27D3931DC8BB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asa-5506w-x:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D78BA13B-49B2-4ECF-A69D-5C14EAB6B118",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asa-5508-x:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5806FA7C-356B-45BB-ABB0-54B87167AF77",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asa-5516-x:-:*:*:*:*:*:*:*",
"matchCriteriaId": "93289CFF-6A07-46F2-A2E0-5C43C67E0DCD",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asa-5525-x:-:*:*:*:*:*:*:*",
"matchCriteriaId": "45A11CA4-D93C-4D32-81C7-E3CF71EC4BBB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asa-5545-x:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0EF47542-3C2E-4BDB-823F-9A901312C634",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asa-5555-x:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A567EFB6-9A19-4BC0-8EE2-6E2219D09961",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:cisco:asa_5500:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7018906A-ACDF-4D7B-B816-ED9C235BF04E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the Deterministic Random Bit Generator (DRBG), also known as Pseudorandom Number Generator (PRNG), used in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a cryptographic collision, enabling the attacker to discover the private key of an affected device. The vulnerability is due to insufficient entropy in the DRBG when generating cryptographic keys. An attacker could exploit this vulnerability by generating a large number of cryptographic keys on an affected device and looking for collisions with target devices. A successful exploit could allow the attacker to impersonate an affected target device or to decrypt traffic secured by an affected key that is sent to or from an affected target device."
},
{
"lang": "es",
"value": "Una vulnerabilidad en el Deterministic Random Bit Generator (DRBG), conocido como Pseudorandom Number Generator (PRNG), utilizado en los programas Adaptive Security Appliance (ASA) y Firepower Threat Defense (FTD) de Cisco, podr\u00eda permitir que un atacante remoto no identificado genere una colisi\u00f3n criptogr\u00e1fica, que permite al atacante descubrir la clave privada de un dispositivo afectado. La vulnerabilidad se debe a una entrop\u00eda insuficiente en la DRBG al generar claves criptogr\u00e1ficas. Un atacante podr\u00eda atacar esta vulnerabilidad al generar una gran cantidad de claves criptogr\u00e1ficas en un dispositivo afectado y provocar colisiones con los dispositivos de destino. Una operaci\u00f3n exito podr\u00eda permitir al atacante hacerse pasar por un dispositivo de destino afectado o descifrar el tr\u00e1fico protegido por una clave afectada que se env\u00eda desde un dispositivo de destino afectado."
}
],
"id": "CVE-2019-1715",
"lastModified": "2024-11-21T04:37:09.840",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-05-03T17:29:00.593",
"references": [
{
"source": "ykramarz@cisco.com",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-asa-ftd-entropy"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-asa-ftd-entropy"
}
],
"sourceIdentifier": "ykramarz@cisco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-332"
}
],
"source": "ykramarz@cisco.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-332"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2013-04-25 10:55
Modified
2024-11-21 01:49
Severity ?
Summary
The JAR files on Cisco Device Manager for Cisco MDS 9000 devices before 5.2.8, and Cisco Device Manager for Cisco Nexus 5000 devices, allow remote attackers to execute arbitrary commands on Windows client machines via a crafted element-manager.jnlp file, aka Bug IDs CSCty17417 and CSCty10802.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:adaptive_security_appliance_device_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "79FD6080-B82E-4DB6-A4DF-470FE996E07C",
"versionEndIncluding": "5.2.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:adaptive_security_appliance_device_manager:5.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "09BAF24A-AC9F-447E-9C35-315BA6271B2E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:adaptive_security_appliance_device_manager:5.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6741F961-98F5-48C0-853E-C5B5C29172BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:adaptive_security_appliance_device_manager:5.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C84EB0EF-B0AF-4932-A719-31B97BFA3AA2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:adaptive_security_appliance_device_manager:5.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "260A022E-EC6B-4D62-AE08-69F743D89827",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:adaptive_security_appliance_device_manager:5.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "D17331FF-28B0-4EB0-B2FB-8A56218E6037",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:adaptive_security_appliance_device_manager:5.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "98E79DFE-7496-4022-8A24-0723DD28BE9C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:adaptive_security_appliance_device_manager:5.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "E52DAC91-9280-4F7E-A0CF-750700FF3290",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:adaptive_security_appliance_device_manager:5.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "9B77C14F-03F5-4B90-8098-D90AACFC043F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:adaptive_security_appliance_device_manager:5.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "80C9A26D-FBFF-40C5-A041-6BB65511C53A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:adaptive_security_appliance_device_manager:5.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D58402E4-472E-46AE-AC0C-25B12C9C6567",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:adaptive_security_appliance_device_manager:5.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CD03EE75-B7A4-4C7A-B691-FC9E4C8BE594",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:adaptive_security_appliance_device_manager:5.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "73C6A552-F328-4331-BBF8-EA3D6A5B3936",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:adaptive_security_appliance_device_manager:5.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D179D1F3-EB94-4D4F-9B0C-074B59570DAF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:adaptive_security_appliance_device_manager:5.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "8995A10A-C0A0-4297-9F7D-5B4C3D8A26BB",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:nexus_5000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4F2B1E07-8519-4F58-9048-81ABA12E01DC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:cisco:nexus_5010:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E275D31F-4FA1-428E-AB4A-D2802FF0CF1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:cisco:nexus_5010p_switch:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1FD1E96B-1927-42DC-A47B-5632CED2D40F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:cisco:nexus_5020:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BA7F5823-41A8-47C8-A154-02C6C31EF76A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:cisco:nexus_5020p_switch:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0737BA36-75AB-478D-9001-3DA3E49C6F00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:cisco:nexus_5548p:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E5519EA9-1236-4F51-9974-E3FC1B26B5D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:cisco:nexus_5548up:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CB0A3B06-8B25-4CD3-AFA9-5F928B1042F4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:h:cisco:nexus_5596up:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DC4D4403-F93B-4CC8-B75F-7A5B03FEDD85",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:adaptive_security_appliance_device_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "79FD6080-B82E-4DB6-A4DF-470FE996E07C",
"versionEndIncluding": "5.2.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:adaptive_security_appliance_device_manager:5.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "09BAF24A-AC9F-447E-9C35-315BA6271B2E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:adaptive_security_appliance_device_manager:5.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "6741F961-98F5-48C0-853E-C5B5C29172BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:adaptive_security_appliance_device_manager:5.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C84EB0EF-B0AF-4932-A719-31B97BFA3AA2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:adaptive_security_appliance_device_manager:5.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "260A022E-EC6B-4D62-AE08-69F743D89827",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:adaptive_security_appliance_device_manager:5.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "D17331FF-28B0-4EB0-B2FB-8A56218E6037",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:adaptive_security_appliance_device_manager:5.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "98E79DFE-7496-4022-8A24-0723DD28BE9C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:adaptive_security_appliance_device_manager:5.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "E52DAC91-9280-4F7E-A0CF-750700FF3290",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:adaptive_security_appliance_device_manager:5.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "9B77C14F-03F5-4B90-8098-D90AACFC043F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:adaptive_security_appliance_device_manager:5.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "80C9A26D-FBFF-40C5-A041-6BB65511C53A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:adaptive_security_appliance_device_manager:5.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D58402E4-472E-46AE-AC0C-25B12C9C6567",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:adaptive_security_appliance_device_manager:5.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CD03EE75-B7A4-4C7A-B691-FC9E4C8BE594",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:adaptive_security_appliance_device_manager:5.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "73C6A552-F328-4331-BBF8-EA3D6A5B3936",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:adaptive_security_appliance_device_manager:5.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D179D1F3-EB94-4D4F-9B0C-074B59570DAF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:cisco:adaptive_security_appliance_device_manager:5.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "8995A10A-C0A0-4297-9F7D-5B4C3D8A26BB",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cisco:mds_9000:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0F2ED90B-DDBA-49DE-AC78-20E7D77C8858",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The JAR files on Cisco Device Manager for Cisco MDS 9000 devices before 5.2.8, and Cisco Device Manager for Cisco Nexus 5000 devices, allow remote attackers to execute arbitrary commands on Windows client machines via a crafted element-manager.jnlp file, aka Bug IDs CSCty17417 and CSCty10802."
},
{
"lang": "es",
"value": "Los archivos JAR en Cisco Device Manager de dispositivos Cisco MDS 9000 antes de v5.2.8 y Cisco Device Manager dispositivos Nexus 5000, permite a atacantes remotos ejecutar comandos arbitrarios en los equipos cliente de Windows a trav\u00e9s de un archivo de elemento manager.jnlp hecho a mano, tambi\u00e9n conocido como Bug IDs CSCty17417 y CSCty10802."
}
],
"evaluatorImpact": "Per: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130424-fmdm\r\n\r\n\"Cisco Device Manager versions 5.x and earlier. Note: Only Cisco Device Manager software installed or launched via JNLP file on Microsoft Windows is affected by this vulnerability.\"",
"id": "CVE-2013-1192",
"lastModified": "2024-11-21T01:49:05.190",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2013-04-25T10:55:01.787",
"references": [
{
"source": "ykramarz@cisco.com",
"tags": [
"Vendor Advisory"
],
"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130424-fmdm"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130424-fmdm"
}
],
"sourceIdentifier": "ykramarz@cisco.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}