cnvd - cnvd-2017-33270

CNVD-2017-33270

Vulnerability from cnvd - Published: 2017-11-09

Title

Cisco Umbrella Virtual Appliance未授权访问漏洞

Description

Cisco Umbrella Virtual Appliance是美国思科（Cisco）公司的一款基于云的安全互联网网关设备。 Cisco Umbrella Virtual Appliance 2.0.3及之前的版本中存在安全漏洞。远程攻击者可利用该漏洞访问设备，并完全控制设备。

Severity

中

Patch Name

Cisco Umbrella Virtual Appliance未授权访问漏洞的补丁

Patch Description

Cisco Umbrella Virtual Appliance是美国思科（Cisco）公司的一款基于云的安全互联网网关设备。 Cisco Umbrella Virtual Appliance 2.0.3及之前的版本中存在安全漏洞。远程攻击者可利用该漏洞访问设备，并完全控制设备。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://tools.cisco.com/security/center/publicationListing.x#~CiscoSecurityResponse

Reference

https://nvd.nist.gov/vuln/detail/CVE-2017-6679

Impacted products

Name
Cisco Umbrella Virtual Appliance 2.0.3

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "101567"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-6679",
      "cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6679"
    }
  },
  "description": "Cisco Umbrella Virtual Appliance\u662f\u7f8e\u56fd\u601d\u79d1\uff08Cisco\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u57fa\u4e8e\u4e91\u7684\u5b89\u5168\u4e92\u8054\u7f51\u7f51\u5173\u8bbe\u5907\u3002\r\n\r\nCisco Umbrella Virtual Appliance 2.0.3\u53ca\u4e4b\u524d\u7684\u7248\u672c\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u8bbf\u95ee\u8bbe\u5907\uff0c\u5e76\u5b8c\u5168\u63a7\u5236\u8bbe\u5907\u3002",
  "discovererName": "Cisco",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u8fd9\u4e2a\u5b89\u5168\u95ee\u9898\uff0c\u8bf7\u5230\u5382\u5546\u7684\u4e3b\u9875\u4e0b\u8f7d\uff1a\r\nhttp://tools.cisco.com/security/center/publicationListing.x#~CiscoSecurityResponse",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-33270",
  "openTime": "2017-11-09",
  "patchDescription": "Cisco Umbrella Virtual Appliance\u662f\u7f8e\u56fd\u601d\u79d1\uff08Cisco\uff09\u516c\u53f8\u7684\u4e00\u6b3e\u57fa\u4e8e\u4e91\u7684\u5b89\u5168\u4e92\u8054\u7f51\u7f51\u5173\u8bbe\u5907\u3002\r\n\r\nCisco Umbrella Virtual Appliance 2.0.3\u53ca\u4e4b\u524d\u7684\u7248\u672c\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u8bbf\u95ee\u8bbe\u5907\uff0c\u5e76\u5b8c\u5168\u63a7\u5236\u8bbe\u5907\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Cisco Umbrella Virtual Appliance\u672a\u6388\u6743\u8bbf\u95ee\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Cisco Umbrella Virtual Appliance 2.0.3"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2017-6679",
  "serverity": "\u4e2d",
  "submitTime": "2017-10-30",
  "title": "Cisco Umbrella Virtual Appliance\u672a\u6388\u6743\u8bbf\u95ee\u6f0f\u6d1e"
}

CVE-2017-6679 (GCVE-0-2017-6679)

Vulnerability from cvelistv5 – Published: 2017-12-01 00:00 – Updated: 2024-08-05 15:33

Summary

The Cisco Umbrella Virtual Appliance Version 2.0.3 and prior contained an undocumented encrypted remote support tunnel (SSH) which auto initiated from the customer's appliance to Cisco's SSH Hubs in the Umbrella datacenters. These tunnels were primarily leveraged for remote support and allowed for authorized/authenticated personnel from the Cisco Umbrella team to access the appliance remotely and obtain full control without explicit customer approval. To address this vulnerability, the Umbrella Virtual Appliance version 2.1.0 now requires explicit customer approval before an SSH tunnel from the VA to the Cisco terminating server can be established.

Severity ?

No CVSS data available.

CWE

undocumented encrypted remote support tunnel

Assigner

cisco

References

URL

Tags

	https://www.info-sec.ca/advisories/Cisco-Umbrella.html
	https://support.umbrella.com/hc/en-us/articles/11…
	http://www.securityfocus.com/bid/101567	vdb-entry
	https://support.umbrella.com/hc/en-us/articles/11…
	https://sec.cloudapps.cisco.com/security/center/c…	vendor-advisory

Impacted products

	Vendor	Product	Version
	n/a	Cisco Umbrella Virtual Appliance Version 2.0.3 and prior	Affected: Cisco Umbrella Virtual Appliance Version 2.0.3 and prior

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T15:33:20.478Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.info-sec.ca/advisories/Cisco-Umbrella.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.umbrella.com/hc/en-us/articles/115004752143-Virtual-Appliance-Vulnerability-due-to-always-on-SSH-Tunnel-RESOLVED-2017-09-15"
          },
          {
            "name": "101567",
            "tags": [
              "vdb-entry",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/101567"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.umbrella.com/hc/en-us/articles/115004154423"
          },
          {
            "name": "20230816 Cisco Umbrella Virtual Appliance Undocumented Support Tunnel Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-umbrella-tunnel-gJw5thgE"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Cisco Umbrella Virtual Appliance Version 2.0.3 and prior",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Cisco Umbrella Virtual Appliance Version 2.0.3 and prior"
            }
          ]
        }
      ],
      "datePublic": "2017-12-01T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Cisco Umbrella Virtual Appliance Version 2.0.3 and prior contained an undocumented encrypted remote support tunnel (SSH) which auto initiated from the customer\u0027s appliance to Cisco\u0027s SSH Hubs in the Umbrella datacenters. These tunnels were primarily leveraged for remote support and allowed for authorized/authenticated personnel from the Cisco Umbrella team to access the appliance remotely and obtain full control without explicit customer approval. To address this vulnerability, the Umbrella Virtual Appliance version 2.1.0 now requires explicit customer approval before an SSH tunnel from the VA to the Cisco terminating server can be established."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "undocumented encrypted remote support tunnel",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-08-17T18:06:50.353672",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "url": "https://www.info-sec.ca/advisories/Cisco-Umbrella.html"
        },
        {
          "url": "https://support.umbrella.com/hc/en-us/articles/115004752143-Virtual-Appliance-Vulnerability-due-to-always-on-SSH-Tunnel-RESOLVED-2017-09-15"
        },
        {
          "name": "101567",
          "tags": [
            "vdb-entry"
          ],
          "url": "http://www.securityfocus.com/bid/101567"
        },
        {
          "url": "https://support.umbrella.com/hc/en-us/articles/115004154423"
        },
        {
          "name": "20230816 Cisco Umbrella Virtual Appliance Undocumented Support Tunnel Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-umbrella-tunnel-gJw5thgE"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2017-6679",
    "datePublished": "2017-12-01T00:00:00",
    "dateReserved": "2017-03-09T00:00:00",
    "dateUpdated": "2024-08-05T15:33:20.478Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2017-33270

CVE-2017-6679 (GCVE-0-2017-6679)

Tags

Sightings

Nomenclature