Refine your search
38 vulnerabilities found for IOS XR by Cisco
CERTFR-2025-AVI-0819
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits Cisco. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et un contournement de la politique de sécurité.
Cisco indique que les vulnérabilités CVE-2025-20333 et CVE-2025-20362 sont activement exploitées.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | Firepower Threat Defense | Firewall Threat Defense (FTD) versions 7.7.x antérieures à 7.7.10.1 | ||
| Cisco | Adaptive Security Appliance | Adaptive Security Appliance (ASA) versions 9.17.x et 9.18.x antérieures à 9.18.4.67 | ||
| Cisco | Firepower Threat Defense | Firewall Threat Defense (FTD) versions 7.3.x et 7.4.x antérieures à 7.4.2.4 | ||
| Cisco | IOS XE | IOS XE, se référer au bulletin de sécurité de l'éditeur pour les versions vulnérables (cf. section Documentation) | ||
| Cisco | Adaptive Security Appliance | Adaptive Security Appliance (ASA) versions 9.16.x antérieures à 9.16.4.85 | ||
| Cisco | IOS | IOS, se référer au bulletin de sécurité de l'éditeur pour les versions vulnérables (cf. section Documentation) | ||
| Cisco | Adaptive Security Appliance | Adaptive Security Appliance (ASA) versions 9.19.x et 9.20.x antérieures à 9.20.4.10 | ||
| Cisco | Adaptive Security Appliance | Adaptive Security Appliance (ASA) versions 9.12.x antérieures à 9.12.4.72 | ||
| Cisco | Adaptive Security Appliance | Adaptive Security Appliance (ASA) versions 9.23.x antérieures à 9.23.1.19 | ||
| Cisco | Firepower Threat Defense | Firewall Threat Defense (FTD) versions 7.0.x antérieures à 7.0.8.1 | ||
| Cisco | Adaptive Security Appliance | Adaptive Security Appliance (ASA) versions 9.22.x antérieures à 9.22.2.14 | ||
| Cisco | IOS XR | IOS XR version 6.8 sur architecture 32 bits | ||
| Cisco | IOS XR | IOS XR version 6.9 sur architecture 32 bits | ||
| Cisco | Firepower Threat Defense | Firewall Threat Defense (FTD) versions 7.6.x antérieures à 7.6.2.1 | ||
| Cisco | Adaptive Security Appliance | Adaptive Security Appliance (ASA) versions 9.14.x antérieures à 9.14.4.28 | ||
| Cisco | Firepower Threat Defense | Firewall Threat Defense (FTD) versions 7.1.x et 7.2.x antérieures à 7.2.10.2 |
References
| Title | Publication Time | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Firewall Threat Defense (FTD) versions 7.7.x ant\u00e9rieures \u00e0 7.7.10.1",
"product": {
"name": "Firepower Threat Defense",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Adaptive Security Appliance (ASA) versions 9.17.x et 9.18.x ant\u00e9rieures \u00e0 9.18.4.67",
"product": {
"name": "Adaptive Security Appliance",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Firewall Threat Defense (FTD) versions 7.3.x et 7.4.x ant\u00e9rieures \u00e0 7.4.2.4",
"product": {
"name": "Firepower Threat Defense",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IOS XE, se r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour les versions vuln\u00e9rables (cf. section Documentation)",
"product": {
"name": "IOS XE",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Adaptive Security Appliance (ASA) versions 9.16.x ant\u00e9rieures \u00e0 9.16.4.85",
"product": {
"name": "Adaptive Security Appliance",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IOS, se r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour les versions vuln\u00e9rables (cf. section Documentation)",
"product": {
"name": "IOS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Adaptive Security Appliance (ASA) versions 9.19.x et 9.20.x ant\u00e9rieures \u00e0 9.20.4.10",
"product": {
"name": "Adaptive Security Appliance",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Adaptive Security Appliance (ASA) versions 9.12.x ant\u00e9rieures \u00e0 9.12.4.72",
"product": {
"name": "Adaptive Security Appliance",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Adaptive Security Appliance (ASA) versions 9.23.x ant\u00e9rieures \u00e0 9.23.1.19",
"product": {
"name": "Adaptive Security Appliance",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Firewall Threat Defense (FTD) versions 7.0.x ant\u00e9rieures \u00e0 7.0.8.1",
"product": {
"name": "Firepower Threat Defense",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Adaptive Security Appliance (ASA) versions 9.22.x ant\u00e9rieures \u00e0 9.22.2.14",
"product": {
"name": "Adaptive Security Appliance",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IOS XR version 6.8 sur architecture 32 bits",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IOS XR version 6.9 sur architecture 32 bits",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Firewall Threat Defense (FTD) versions 7.6.x ant\u00e9rieures \u00e0 7.6.2.1 ",
"product": {
"name": "Firepower Threat Defense",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Adaptive Security Appliance (ASA) versions 9.14.x ant\u00e9rieures \u00e0 9.14.4.28",
"product": {
"name": "Adaptive Security Appliance",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Firewall Threat Defense (FTD) versions 7.1.x et 7.2.x ant\u00e9rieures \u00e0 7.2.10.2",
"product": {
"name": "Firepower Threat Defense",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-20333",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20333"
},
{
"name": "CVE-2025-20362",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20362"
},
{
"name": "CVE-2025-20363",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20363"
}
],
"initial_release_date": "2025-09-25T00:00:00",
"last_revision_date": "2025-09-25T00:00:00",
"links": [],
"reference": "CERTFR-2025-AVI-0819",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-09-25T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Cisco. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance et un contournement de la politique de s\u00e9curit\u00e9.\n\nCisco indique que les vuln\u00e9rabilit\u00e9s CVE-2025-20333 et CVE-2025-20362 sont activement exploit\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
"vendor_advisories": [
{
"published_at": "2025-09-25",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-http-code-exec-WmfP3h3O",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http-code-exec-WmfP3h3O"
},
{
"published_at": "2025-09-25",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-asaftd-webvpn-z5xP8EUB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-z5xP8EUB"
},
{
"published_at": "2025-09-25",
"title": "Billet de blogue Cisco asa_ftd_continued_attacks",
"url": "https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks"
},
{
"published_at": "2025-09-25",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-asaftd-webvpn-YROOTUW",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW"
}
]
}
CERTFR-2025-AVI-0781
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans Cisco IOS XR. Elles permettent à un attaquant de provoquer un déni de service à distance et un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "IOS XR versions ant\u00e9rieures \u00e0 24.2.21",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IOS XR versions 24.3.x \u00e0 25.1.x ant\u00e9rieures \u00e0 25.1.2",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IOS XR versions 25.2.x ant\u00e9rieures \u00e0 25.2.1",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-20248",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20248"
},
{
"name": "CVE-2025-20340",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20340"
}
],
"initial_release_date": "2025-09-11T00:00:00",
"last_revision_date": "2025-09-11T00:00:00",
"links": [],
"reference": "CERTFR-2025-AVI-0781",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-09-11T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Cisco IOS XR. Elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance et un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Cisco IOS XR",
"vendor_advisories": [
{
"published_at": "2025-09-10",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-xrsig-UY4zRUCG",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xrsig-UY4zRUCG"
},
{
"published_at": "2025-09-10",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-iosxr-arp-storm-EjUU55yM",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-arp-storm-EjUU55yM"
}
]
}
CERTFR-2025-AVI-0378
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits Cisco. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | Catalyst Center | Catalyst Center versions antérieures à 2.3.7.9 | ||
| Cisco | Catalyst SD-WAN | Catalyst SD-WAN Manager versions 20.13.x, 20.14.x et 20.15.x antérieures à 20.15.2 | ||
| Cisco | Catalyst SD-WAN | Catalyst SD-WAN Manager versions 20.16.x antérieures à 20.16.1 | ||
| Cisco | IOS XR | IOS XR versions antérieures à 24.3.2 | ||
| Cisco | WLC AireOS | WLC AireOS versions antérieures à 8.10.196.0 | ||
| Cisco | Catalyst SD-WAN | Catalyst SD-WAN Manager versions antérieures à 20.9.7 | ||
| Cisco | IOS XE | IOS XE : Se référer aux bulletins de sécurité de l'éditeur pour l'obtention des configurations vulnérables des équipements (cf. section Documentation). | ||
| Cisco | Catalyst SD-WAN | Catalyst SD-WAN Manager versions 20.10.x, 20.11.x et 20.12.x antérieures à 20.12.5 |
References
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Catalyst Center versions ant\u00e9rieures \u00e0 2.3.7.9",
"product": {
"name": "Catalyst Center",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Catalyst SD-WAN Manager versions 20.13.x, 20.14.x et 20.15.x ant\u00e9rieures \u00e0 20.15.2",
"product": {
"name": "Catalyst SD-WAN",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Catalyst SD-WAN Manager versions 20.16.x ant\u00e9rieures \u00e0 20.16.1",
"product": {
"name": "Catalyst SD-WAN",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IOS XR versions ant\u00e9rieures \u00e0 24.3.2",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "WLC AireOS versions ant\u00e9rieures \u00e0 8.10.196.0",
"product": {
"name": "WLC AireOS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Catalyst SD-WAN Manager versions ant\u00e9rieures \u00e0 20.9.7",
"product": {
"name": "Catalyst SD-WAN",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IOS XE : Se r\u00e9f\u00e9rer aux bulletins de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des configurations vuln\u00e9rables des \u00e9quipements (cf. section Documentation).",
"product": {
"name": "IOS XE",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Catalyst SD-WAN Manager versions 20.10.x, 20.11.x et 20.12.x ant\u00e9rieures \u00e0 20.12.5",
"product": {
"name": "Catalyst SD-WAN",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-20189",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20189"
},
{
"name": "CVE-2025-20192",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20192"
},
{
"name": "CVE-2025-20199",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20199"
},
{
"name": "CVE-2025-20191",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20191"
},
{
"name": "CVE-2025-20188",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20188"
},
{
"name": "CVE-2025-20198",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20198"
},
{
"name": "CVE-2025-20181",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20181"
},
{
"name": "CVE-2025-20122",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20122"
},
{
"name": "CVE-2025-20202",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20202"
},
{
"name": "CVE-2025-20210",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20210"
},
{
"name": "CVE-2025-20162",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20162"
},
{
"name": "CVE-2025-20200",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20200"
},
{
"name": "CVE-2025-20154",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20154"
},
{
"name": "CVE-2025-20140",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20140"
},
{
"name": "CVE-2025-20201",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20201"
},
{
"name": "CVE-2025-20186",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20186"
},
{
"name": "CVE-2025-20182",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20182"
},
{
"name": "CVE-2025-20197",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20197"
},
{
"name": "CVE-2025-20164",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20164"
}
],
"initial_release_date": "2025-05-09T00:00:00",
"last_revision_date": "2025-05-09T00:00:00",
"links": [],
"reference": "CERTFR-2025-AVI-0378",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-05-09T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Cisco. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
"vendor_advisories": [
{
"published_at": "2025-05-07",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-iosxe-ikev1-dos-XHk3HzFC",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-ikev1-dos-XHk3HzFC"
},
{
"published_at": "2025-05-07",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-twamp-kV4FHugn",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-twamp-kV4FHugn"
},
{
"published_at": "2025-05-07",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-iosxe-privesc-su7scvdp",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-privesc-su7scvdp"
},
{
"published_at": "2025-05-07",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-sisf-dos-ZGwt4DdY",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sisf-dos-ZGwt4DdY"
},
{
"published_at": "2025-05-07",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-webui-cmdinj-gVn3OKNC",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-cmdinj-gVn3OKNC"
},
{
"published_at": "2025-05-07",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ios-http-privesc-wCRd5e3",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-http-privesc-wCRd5e3"
},
{
"published_at": "2025-05-07",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-asr903-rsp3-arp-dos-WmfzdvJZ",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asr903-rsp3-arp-dos-WmfzdvJZ"
},
{
"published_at": "2025-05-07",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ewlc-cdp-dos-fpeks9K",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ewlc-cdp-dos-fpeks9K"
},
{
"published_at": "2025-05-07",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-wlc-wncd-p6Gvt6HL",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wlc-wncd-p6Gvt6HL"
},
{
"published_at": "2025-05-07",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-dnac-api-nBPZcJCM",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnac-api-nBPZcJCM"
},
{
"published_at": "2025-05-07",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-c2960-3560-sboot-ZtqADrHq",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-c2960-3560-sboot-ZtqADrHq"
},
{
"published_at": "2025-05-07",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-multiprod-ikev2-dos-gPctUqv2",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-multiprod-ikev2-dos-gPctUqv2"
},
{
"published_at": "2025-05-07",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-sdwan-priviesc-WCk7bmmt",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-priviesc-WCk7bmmt"
},
{
"published_at": "2025-05-07",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-wlc-file-uplpd-rHZG9UfC",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wlc-file-uplpd-rHZG9UfC"
},
{
"published_at": "2025-05-07",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-iosxe-dhcpsn-dos-xBn8Mtks",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-dhcpsn-dos-xBn8Mtks"
}
]
}
CERTFR-2025-AVI-0207
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans Cisco IOS XR. Elles permettent à un attaquant de provoquer une élévation de privilèges, un déni de service à distance et un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
L'éditeur indique que pour les versions 24.x, la mise à jour 24.2.21 corrigera les vulnérabilités CVE-2025-20138 et CVE-2025-20146,
Impacted products
References
| Title | Publication Time | Tags | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "IOS XR Software versions 24.4.x ant\u00e9rieures \u00e0 24.4.1",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IOS XR Software versions 7.x ant\u00e9rieures \u00e0 7.11.21 ",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IOS XR Software versions 24.3.x ant\u00e9rieures \u00e0 24.3.2",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IOS XR Software versions 24.x ant\u00e9rieures \u00e0 24.2.2",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": "L\u0027\u00e9diteur indique que pour les versions 24.x, la mise \u00e0 jour 24.2.21 corrigera les vuln\u00e9rabilit\u00e9s CVE-2025-20138 et CVE-2025-20146,",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-20177",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20177"
},
{
"name": "CVE-2025-20209",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20209"
},
{
"name": "CVE-2025-20146",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20146"
},
{
"name": "CVE-2025-20143",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20143"
},
{
"name": "CVE-2025-20142",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20142"
},
{
"name": "CVE-2025-20141",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20141"
},
{
"name": "CVE-2025-20138",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20138"
}
],
"initial_release_date": "2025-03-13T00:00:00",
"last_revision_date": "2025-03-13T00:00:00",
"links": [],
"reference": "CERTFR-2025-AVI-0207",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-03-13T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Cisco IOS XR. Elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, un d\u00e9ni de service \u00e0 distance et un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Cisco IOS XR ",
"vendor_advisories": [
{
"published_at": "2025-03-12",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-xr792-bWfVDPY",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xr792-bWfVDPY"
},
{
"published_at": "2025-03-12",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-xrike-9wYGpRGq",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xrike-9wYGpRGq"
},
{
"published_at": "2025-03-12",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ipv4uni-LfM3cfBu",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipv4uni-LfM3cfBu"
},
{
"published_at": "2025-03-12",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-iosxr-priv-esc-GFQjxvOF",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-priv-esc-GFQjxvOF"
},
{
"published_at": "2025-03-12",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-sb-lkm-zNErZjbZ",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-lkm-zNErZjbZ"
},
{
"published_at": "2025-03-12",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ios-xr-verii-bypass-HhPwQRvx",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xr-verii-bypass-HhPwQRvx"
},
{
"published_at": "2025-03-12",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-multicast-ERMrSvq7",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-multicast-ERMrSvq7"
}
]
}
CERTFR-2025-AVI-0100
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits Cisco. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | IOS | IOS versions 15.2E antérieures à 15.2(7)E12 (disponibilité prévue pour mars 2025) | ||
| Cisco | N/A | ISE versions 3.3 antérieures à 3.3P4 | ||
| Cisco | IOS XE | IOS XE Software versions 16.12 antérieures à 16.12.13 (disponibilité prévue pour mars 2025) | ||
| Cisco | IOS XR | IOS XR Software versions 24.2 antérieures à 24.2.21 | ||
| Cisco | N/A | ISE versions 3.2 antérieures à 3.2P7 | ||
| Cisco | IOS XR | IOS XR Software versions postérieures à 24.3 et antérieures à 24.4.2 | ||
| Cisco | IOS XE | IOS XE Software versions 3.11E antérieures à 3.11.12E (disponibilité prévue pour mars 2025) | ||
| Cisco | IOS XR | IOS XR Software versions 25.2 antérieures à 25.2.1 | ||
| Cisco | N/A | ISE versions postérieures à 3.0 et antérieures à 3.1P10 | ||
| Cisco | IOS XE | IOS XE Software versions 17.15 antérieures à 17.15.3 (disponibilité prévue pour mars 2025) | ||
| Cisco | IOS | IOS versions 15.5SY antérieures à 15.5(1)SY15 (disponibilité prévue pour mars 2025) | ||
| Cisco | IOS XE | IOS XE Software versions 17.9 antérieures à 17.9.7 (disponibilité prévue pour mars 2025) | ||
| Cisco | IOS | IOS versions 15.9M antérieures à 15.9(3)M11 (disponibilité prévue pour février 2025) | ||
| Cisco | IOS XE | IOS XE Software versions 17.12 antérieures à 17.12.5 (disponibilité prévue pour février 2025) |
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "IOS versions 15.2E ant\u00e9rieures \u00e0 15.2(7)E12 (disponibilit\u00e9 pr\u00e9vue pour mars 2025)",
"product": {
"name": "IOS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "ISE versions 3.3 ant\u00e9rieures \u00e0 3.3P4",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IOS XE Software versions 16.12 ant\u00e9rieures \u00e0 16.12.13 (disponibilit\u00e9 pr\u00e9vue pour mars 2025)",
"product": {
"name": "IOS XE",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IOS XR Software versions 24.2 ant\u00e9rieures \u00e0 24.2.21",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "ISE versions 3.2 ant\u00e9rieures \u00e0 3.2P7",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IOS XR Software versions post\u00e9rieures \u00e0 24.3 et ant\u00e9rieures \u00e0 24.4.2",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IOS XE Software versions 3.11E ant\u00e9rieures \u00e0 3.11.12E (disponibilit\u00e9 pr\u00e9vue pour mars 2025)",
"product": {
"name": "IOS XE",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IOS XR Software versions 25.2 ant\u00e9rieures \u00e0 25.2.1",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "ISE versions post\u00e9rieures \u00e0 3.0 et ant\u00e9rieures \u00e0 3.1P10",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IOS XE Software versions 17.15 ant\u00e9rieures \u00e0 17.15.3 (disponibilit\u00e9 pr\u00e9vue pour mars 2025)",
"product": {
"name": "IOS XE",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IOS versions 15.5SY ant\u00e9rieures \u00e0 15.5(1)SY15 (disponibilit\u00e9 pr\u00e9vue pour mars 2025)",
"product": {
"name": "IOS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IOS XE Software versions 17.9 ant\u00e9rieures \u00e0 17.9.7 (disponibilit\u00e9 pr\u00e9vue pour mars 2025)",
"product": {
"name": "IOS XE",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IOS versions 15.9M ant\u00e9rieures \u00e0 15.9(3)M11 (disponibilit\u00e9 pr\u00e9vue pour f\u00e9vrier 2025)",
"product": {
"name": "IOS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IOS XE Software versions 17.12 ant\u00e9rieures \u00e0 17.12.5 (disponibilit\u00e9 pr\u00e9vue pour f\u00e9vrier 2025)",
"product": {
"name": "IOS XE",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-20174",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20174"
},
{
"name": "CVE-2025-20173",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20173"
},
{
"name": "CVE-2025-20170",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20170"
},
{
"name": "CVE-2025-20125",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20125"
},
{
"name": "CVE-2025-20172",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20172"
},
{
"name": "CVE-2025-20169",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20169"
},
{
"name": "CVE-2025-20175",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20175"
},
{
"name": "CVE-2025-20124",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20124"
},
{
"name": "CVE-2025-20176",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20176"
},
{
"name": "CVE-2025-20171",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20171"
}
],
"initial_release_date": "2025-02-06T00:00:00",
"last_revision_date": "2025-02-06T00:00:00",
"links": [],
"reference": "CERTFR-2025-AVI-0100",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-02-06T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Cisco. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
"vendor_advisories": [
{
"published_at": "2025-02-04",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ise-multivuls-FTW9AOXF",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-multivuls-FTW9AOXF"
},
{
"published_at": "2025-02-04",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-snmp-dos-sdxnSUcW",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snmp-dos-sdxnSUcW"
}
]
}
CERTFR-2024-AVI-0772
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits Cisco. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | Crosswork NSO | Crosswork NSO versions 6.1.x antérieures à 6.1.9 | ||
| Cisco | Routed Passive Optical Network Controller | Routed Passive Optical Network Controller versions antérieures à 24.4.1 | ||
| Cisco | IOS XR | IOS XR versions postérieures à 24.1.x et antérieures à 24.2.2 | ||
| Cisco | Crosswork NSO | Crosswork NSO versions 6.2.x antérieures à 6.2.3 | ||
| Cisco | IOS XR | IOS XR versions 24.4.x antérieures à 24.4.1 | ||
| Cisco | Crosswork NSO | Crosswork NSO versions 5.8.x antérieures à 5.8.13.1 | ||
| Cisco | ConfD | ConfD versions 7.7.x antérieures à 7.7.16 | ||
| Cisco | Crosswork NSO | Crosswork NSO versions 5.5.x antérieures à 5.5.10.1 | ||
| Cisco | ConfD | ConfD versions 7.5.x antérieures à 7.5.10.2 | ||
| Cisco | Crosswork NSO | Crosswork NSO versions 6.0.x antérieures à 6.0.13 | ||
| Cisco | Crosswork NSO | Crosswork NSO versions 5.7.x antérieures à 5.7.16 | ||
| Cisco | IOS XR | IOS XR versions postérieures à 7.10.x antérieures à 7.11.21 | ||
| Cisco | Crosswork NSO | Crosswork NSO versions 5.6.x antérieures à 5.6.14.3 | ||
| Cisco | ConfD | ConfD versions 8.0.x antérieures à 8.0.13 | ||
| Cisco | Optical Site Manager | Optical Site Manager versions antérieures à 24.3.1 |
References
| Title | Publication Time | Tags | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Crosswork NSO versions 6.1.x ant\u00e9rieures \u00e0 6.1.9",
"product": {
"name": "Crosswork NSO",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Routed Passive Optical Network Controller versions ant\u00e9rieures \u00e0 24.4.1",
"product": {
"name": "Routed Passive Optical Network Controller",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IOS XR versions post\u00e9rieures \u00e0 24.1.x et ant\u00e9rieures \u00e0 24.2.2 ",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Crosswork NSO versions 6.2.x ant\u00e9rieures \u00e0 6.2.3",
"product": {
"name": "Crosswork NSO",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IOS XR versions 24.4.x ant\u00e9rieures \u00e0 24.4.1",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Crosswork NSO versions 5.8.x ant\u00e9rieures \u00e0 5.8.13.1",
"product": {
"name": "Crosswork NSO",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "ConfD versions 7.7.x ant\u00e9rieures \u00e0 7.7.16",
"product": {
"name": "ConfD",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Crosswork NSO versions 5.5.x ant\u00e9rieures \u00e0 5.5.10.1",
"product": {
"name": "Crosswork NSO",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "ConfD versions 7.5.x ant\u00e9rieures \u00e0 7.5.10.2",
"product": {
"name": "ConfD",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Crosswork NSO versions 6.0.x ant\u00e9rieures \u00e0 6.0.13",
"product": {
"name": "Crosswork NSO",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Crosswork NSO versions 5.7.x ant\u00e9rieures \u00e0 5.7.16",
"product": {
"name": "Crosswork NSO",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IOS XR versions post\u00e9rieures \u00e0 7.10.x ant\u00e9rieures \u00e0 7.11.21",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Crosswork NSO versions 5.6.x ant\u00e9rieures \u00e0 5.6.14.3",
"product": {
"name": "Crosswork NSO",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "ConfD versions 8.0.x ant\u00e9rieures \u00e0 8.0.13",
"product": {
"name": "ConfD",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Optical Site Manager versions ant\u00e9rieures \u00e0 24.3.1",
"product": {
"name": "Optical Site Manager",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-20406",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20406"
},
{
"name": "CVE-2024-20483",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20483"
},
{
"name": "CVE-2024-20317",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20317"
},
{
"name": "CVE-2024-20489",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20489"
},
{
"name": "CVE-2024-20398",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20398"
},
{
"name": "CVE-2024-20381",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20381"
},
{
"name": "CVE-2024-20304",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20304"
}
],
"initial_release_date": "2024-09-12T00:00:00",
"last_revision_date": "2024-09-12T00:00:00",
"links": [],
"reference": "CERTFR-2024-AVI-0772",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-09-12T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Cisco. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
"vendor_advisories": [
{
"published_at": "2024-09-11",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-nso-auth-bypass-QnTEesp",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nso-auth-bypass-QnTEesp"
},
{
"published_at": "2024-09-11",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-iosxr-ponctlr-ci-OHcHmsFL",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-ponctlr-ci-OHcHmsFL"
},
{
"published_at": "2024-09-11",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-isis-xehpbVNe",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-isis-xehpbVNe"
},
{
"published_at": "2024-09-11",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-l2services-2mvHdNuC",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-l2services-2mvHdNuC"
},
{
"published_at": "2024-09-11",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-iosxr-priv-esc-CrG5vhCq",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-priv-esc-CrG5vhCq"
},
{
"published_at": "2024-09-11",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-pak-mem-exhst-3ke9FeFy",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-pak-mem-exhst-3ke9FeFy"
}
]
}
CERTFR-2024-AVI-0569
Vulnerability from certfr_avis
Une vulnérabilité a été découverte dans les produits Cisco. Elle permet à un attaquant de provoquer une exécution de code arbitraire.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "IOS XR versions ant\u00e9rieures \u00e0 24.2.11",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-20456",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20456"
}
],
"initial_release_date": "2024-07-11T00:00:00",
"last_revision_date": "2024-07-11T00:00:00",
"links": [],
"reference": "CERTFR-2024-AVI-0569",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-07-11T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans les produits Cisco. Elle permet \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire.",
"title": "Vuln\u00e9rabilit\u00e9 dans les produits Cisco",
"vendor_advisories": [
{
"published_at": "2024-07-10",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-xr-secure-boot-quD5g8Ap",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xr-secure-boot-quD5g8Ap"
}
]
}
CERTFR-2024-AVI-0220
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans Cisco IOS XR. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges et un déni de service à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Contournement provisoire
S’il n’est pas possible de procéder à l’installation d’une version corrigeant la vulnérabilité, se référer aux mesures de contournement proposées par l’éditeur à la section Workaround.
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | IOS XR | IOS XR sur ASR9K-X64 versions 7.3.2 sans le SMU asr9k-x64-7.3.2.CSCwe29150 | ||
| Cisco | IOS XR | IOS XR sur ASR9K-X64 versions 7.8.2 sans le SMU asr9k-x64-7.8.2.CSCwe29150 | ||
| Cisco | IOS XR | IOS XR sur XRD-VROUTER versions 7.8.2 sans le SMU xrd-vrouter-7.8.2.CSCwe29150 | ||
| Cisco | IOS XR | IOS XR sur ASR9K-X64 versions 7.7.2 sans le SMU asr9k-x64-7.7.2.CSCwe29150 | ||
| Cisco | IOS XR | IOS XR sur ASR9K-X64 versions 7.4.2 sans le SMU asr9k-x64-7.4.2.CSCwe29150 | ||
| Cisco | IOS XR | IOS XR versions 7.11.x antérieures à 7.11.1 | ||
| Cisco | IOS XR | IOS XR versions 7.x.x antérieures à 7.10.2 | ||
| Cisco | IOS XR | IOS XR sur ASR9K-X64 versions 7.5.2 sans les SMU asr9k-x64-7.5.2.CSCwe29150 et asr9k-x64-7.5.2.CSCwf75789 |
References
| Title | Publication Time | Tags | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "IOS XR sur ASR9K-X64 versions 7.3.2 sans le SMU asr9k-x64-7.3.2.CSCwe29150",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IOS XR sur ASR9K-X64 versions 7.8.2 sans le SMU asr9k-x64-7.8.2.CSCwe29150",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IOS XR sur XRD-VROUTER versions 7.8.2 sans le SMU xrd-vrouter-7.8.2.CSCwe29150",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IOS XR sur ASR9K-X64 versions 7.7.2 sans le SMU asr9k-x64-7.7.2.CSCwe29150",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IOS XR sur ASR9K-X64 versions 7.4.2 sans le SMU asr9k-x64-7.4.2.CSCwe29150",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IOS XR versions 7.11.x ant\u00e9rieures \u00e0 7.11.1",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IOS XR versions 7.x.x ant\u00e9rieures \u00e0 7.10.2",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IOS XR sur ASR9K-X64 versions 7.5.2 sans les SMU asr9k-x64-7.5.2.CSCwe29150 et asr9k-x64-7.5.2.CSCwf75789",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n\n## Contournement provisoire\n\nS\u2019il n\u2019est pas possible de proc\u00e9der \u00e0 l\u2019installation d\u2019une version\ncorrigeant la vuln\u00e9rabilit\u00e9, se r\u00e9f\u00e9rer aux mesures de contournement\npropos\u00e9es par l\u2019\u00e9diteur \u00e0 la section *Workaround*.\n",
"cves": [
{
"name": "CVE-2024-20320",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20320"
},
{
"name": "CVE-2024-20318",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20318"
},
{
"name": "CVE-2024-20327",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-20327"
}
],
"initial_release_date": "2024-03-14T00:00:00",
"last_revision_date": "2024-03-14T00:00:00",
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco\u00a0cisco-sa-xrl2vpn-jesrU3fc du 13 mars 2024",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xrl2vpn-jesrU3fc"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco\u00a0cisco-sa-iosxr-ssh-privesc-eWDMKew3 du 13 mars 2024",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-ssh-privesc-eWDMKew3"
}
],
"reference": "CERTFR-2024-AVI-0220",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-03-14T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans \u003cspan\nclass=\"textit\"\u003eCisco IOS XR\u003c/span\u003e. Certaines d\u0027entre elles permettent \u00e0\nun attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de\nservice \u00e0 distance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Cisco IOS XR",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-iosxr-pppma-JKWFgneW du 13 mars 2024",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-pppma-JKWFgneW"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-xrl2vpn-jesrU3fc du 13 mars 2024",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-iosxr-ssh-privesc-eWDMKew3 du 13 mars 2024",
"url": null
}
]
}
CERTFR-2023-AVI-0207
Vulnerability from certfr_avis
Une vulnérabilité a été découverte dans Cisco IOS XR. Elle permet à un attaquant de provoquer un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | IOS XR | Cisco IOS XR versions 7.7.x antérieures à 7.7.1 | ||
| Cisco | IOS XR | Cisco IOS XR versions 7.1.3 sans le correctif de sécurité asr9k-x64-7.1.3.CSCwc39336 | ||
| Cisco | IOS XR | Cisco IOS XR versions 7.3.2 sans le correctif de sécurité asr9k-x64-7.3.2.CSCwc39336 | ||
| Cisco | IOS XR | Cisco IOS XR versions 7.5.x antérieures à 7.5.3 | ||
| Cisco | IOS XR | Cisco IOS XR versions 7.5.2 sans le correctif de sécurité asr9k-x64-7.5.2.CSCwc39336 | ||
| Cisco | IOS XR | Cisco IOS XR versions 7.6.x antérieures à 7.6.2 |
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Cisco IOS XR versions 7.7.x ant\u00e9rieures \u00e0 7.7.1",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR versions 7.1.3 sans le correctif de s\u00e9curit\u00e9 asr9k-x64-7.1.3.CSCwc39336",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR versions 7.3.2 sans le correctif de s\u00e9curit\u00e9 asr9k-x64-7.3.2.CSCwc39336",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR versions 7.5.x ant\u00e9rieures \u00e0 7.5.3",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR versions 7.5.2 sans le correctif de s\u00e9curit\u00e9 asr9k-x64-7.5.2.CSCwc39336",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR versions 7.6.x ant\u00e9rieures \u00e0 7.6.2",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-20049",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-20049"
}
],
"initial_release_date": "2023-03-09T00:00:00",
"last_revision_date": "2023-03-09T00:00:00",
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco du 08 mars 2023",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bfd-XmRescbT"
}
],
"reference": "CERTFR-2023-AVI-0207",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-03-09T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Cisco IOS XR. Elle permet \u00e0 un\nattaquant de provoquer un d\u00e9ni de service \u00e0 distance et un contournement\nde la politique de s\u00e9curit\u00e9.\n",
"title": "Vuln\u00e9rabilit\u00e9 dans Cisco IOS XR",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco IOS XR du 08 mars 2023",
"url": null
}
]
}
CERTFR-2022-AVI-338
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits Cisco. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs et des mesures de contournement (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | IOS | Cisco IOS avec une configuration HTTP Server spécifique décrite dans l'avis de sécurité de l'éditeur | ||
| Cisco | N/A | Cisco Wireless LAN Controller versions 8.10.151.0 et suivantes antérieures à 8.10.171.0 | ||
| Cisco | IOS | Cisco logiciel IOS versions 15.2(7)E.x antérieures à 15.2(7)E5 | ||
| Cisco | IOS | Cisco logiciel IOS versions 15.2(8)E.x antérieures à 15.2(8)E1 | ||
| Cisco | N/A | Cisco gamme de commutateurs Catalyst 9400 | ||
| Cisco | N/A | Cisco SD-WAN versions 20.7.x antérieures à 20.7.1 | ||
| Cisco | N/A | Cisco 1000 Series Integrated Services Routers | ||
| Cisco | N/A | Cisco Embedded Wireless Controller avec le logiciel Catalyst Access Points versions 17.3.x antérieures à 17.3.4 | ||
| Cisco | N/A | Cisco 4000 Series Integrated Services Routers | ||
| Cisco | IOS XR | Cisco IOS XR versions 7.3.x antérieures à 7.3.2 | ||
| Cisco | IOS XE | Cisco IOS XE entre les séries de versions 3SE et 3E | ||
| Cisco | IOS XR | Cisco IOS XR versions 7.1.2 sans le SMU asr9k-x64-7.1.2.CSCvy48962 ou le service pack asr9k-px-7.1.2.k9-sp1.tar | ||
| Cisco | N/A | Cisco gamme de commutateurs Catalyst 9300 | ||
| Cisco | N/A | Cisco Embedded Wireless Controller avec le logiciel Catalyst Access Points versions 17.6.x antérieures à 17.6.1 | ||
| Cisco | N/A | Cisco gamme de routeurs Catalyst 8300 | ||
| Cisco | N/A | Cisco Catalyst 9800 Series Wireless Controllers | ||
| Cisco | N/A | Cisco 1000 Series Connected Grid Router (CGR1K) | ||
| Cisco | N/A | Cisco Cloud Services Router 1000V Series | ||
| Cisco | N/A | Cisco Catalyst 9800 Embedded Wireless Controllers pour la gamme de commutateurs Catalyst 9300, 9400 et 9500 | ||
| Cisco | N/A | Cisco routeurs ASR 1001-X | ||
| Cisco | N/A | Cisco gamme de commutateurs Catalyst 9500 | ||
| Cisco | N/A | Cisco routeurs ASR 1002-X | ||
| Cisco | IOS XE | Cisco IOS XE versions antérieures à 17.3.1 | ||
| Cisco | N/A | Cisco Embedded Wireless Controllers sur Catalyst Access Points | ||
| Cisco | N/A | Cisco logiciel Catalyst 8000V Edge | ||
| Cisco | N/A | Cisco Catalyst 9800-CL Wireless Controllers pour le Cloud | ||
| Cisco | N/A | Cisco gamme de routeurs Catalyst 8500 | ||
| Cisco | IOS XR | Cisco IOS XR versions 7.1.3 sans le SMU asr9k-x64-7.1.3.CSCvz75757 | ||
| Cisco | N/A | Cisco SD-WAN versions 20.6.x antérieures à 20.6.1 |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Cisco IOS avec une configuration HTTP Server sp\u00e9cifique d\u00e9crite dans l\u0027avis de s\u00e9curit\u00e9 de l\u0027\u00e9diteur",
"product": {
"name": "IOS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Wireless LAN Controller versions 8.10.151.0 et suivantes ant\u00e9rieures \u00e0 8.10.171.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco logiciel IOS versions 15.2(7)E.x ant\u00e9rieures \u00e0 15.2(7)E5",
"product": {
"name": "IOS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco logiciel IOS versions 15.2(8)E.x ant\u00e9rieures \u00e0 15.2(8)E1",
"product": {
"name": "IOS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco gamme de commutateurs Catalyst 9400",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco SD-WAN versions 20.7.x ant\u00e9rieures \u00e0 20.7.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco 1000 Series Integrated Services Routers",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Embedded Wireless Controller avec le logiciel Catalyst Access Points versions 17.3.x ant\u00e9rieures \u00e0 17.3.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco 4000 Series Integrated Services Routers",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR versions 7.3.x ant\u00e9rieures \u00e0 7.3.2",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XE entre les s\u00e9ries de versions 3SE et 3E",
"product": {
"name": "IOS XE",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR versions 7.1.2 sans le SMU asr9k-x64-7.1.2.CSCvy48962 ou le service pack asr9k-px-7.1.2.k9-sp1.tar",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco gamme de commutateurs Catalyst 9300",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Embedded Wireless Controller avec le logiciel Catalyst Access Points versions 17.6.x ant\u00e9rieures \u00e0 17.6.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco gamme de routeurs Catalyst 8300",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Catalyst 9800 Series Wireless Controllers",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco 1000 Series Connected Grid Router (CGR1K)",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Cloud Services Router 1000V Series",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Catalyst 9800 Embedded Wireless Controllers pour la gamme de commutateurs Catalyst 9300, 9400 et 9500",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco routeurs ASR 1001-X",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco gamme de commutateurs Catalyst 9500",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco routeurs ASR 1002-X",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XE versions ant\u00e9rieures \u00e0 17.3.1",
"product": {
"name": "IOS XE",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Embedded Wireless Controllers sur Catalyst Access Points",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco logiciel Catalyst 8000V Edge",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Catalyst 9800-CL Wireless Controllers pour le Cloud",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco gamme de routeurs Catalyst 8500",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR versions 7.1.3 sans le SMU asr9k-x64-7.1.3.CSCvz75757",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco SD-WAN versions 20.6.x ant\u00e9rieures \u00e0 20.6.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs et des mesures de contournement (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-20683",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20683"
},
{
"name": "CVE-2022-20739",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20739"
},
{
"name": "CVE-2022-20716",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20716"
},
{
"name": "CVE-2022-20761",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20761"
},
{
"name": "CVE-2022-20678",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20678"
},
{
"name": "CVE-2022-20681",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20681"
},
{
"name": "CVE-2022-20731",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20731"
},
{
"name": "CVE-2022-20695",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20695"
},
{
"name": "CVE-2022-20684",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20684"
},
{
"name": "CVE-2022-20692",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20692"
},
{
"name": "CVE-2022-20622",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20622"
},
{
"name": "CVE-2022-20697",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20697"
},
{
"name": "CVE-2022-20661",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20661"
},
{
"name": "CVE-2022-20714",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20714"
},
{
"name": "CVE-2022-20682",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20682"
}
],
"initial_release_date": "2022-04-14T00:00:00",
"last_revision_date": "2022-04-14T00:00:00",
"links": [],
"reference": "CERTFR-2022-AVI-338",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-04-14T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Cisco.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire, un d\u00e9ni de service \u00e0 distance et un\ncontournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-c9800-snmp-trap-dos-mjent3Ey du 13 avril 2022",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-c9800-snmp-trap-dos-mjent3Ey"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ewlc-priv-esc-ybvHKO5 du 13 avril 2022",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ewlc-priv-esc-ybvHKO5"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ncossh-dos-ZAkfOdq8 du 13 avril 2022",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ncossh-dos-ZAkfOdq8"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-c9800-fnf-dos-bOL5vLge du 13 avril 2022",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-c9800-fnf-dos-bOL5vLge"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-cdb-cmicr-vulns-KJjFtNb du 13 avril 2022",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cdb-cmicr-vulns-KJjFtNb"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-sdwan-privesc-vman-tEJFpBSL du 13 avril 2022",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-vman-tEJFpBSL"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-lsplus-Z6AQEOjk du 13 avril 2022",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-lsplus-Z6AQEOjk"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-c9800-capwap-mdns-6PSn7gKU du 13 avril 2022",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-c9800-capwap-mdns-6PSn7gKU"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-sd-wan-file-access-VW36d28P du 13 avril 2022",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-file-access-VW36d28P"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ap-ip-flood-dos-6hxxENVQ du 13 avril 2022",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ap-ip-flood-dos-6hxxENVQ"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-wlc-auth-bypass-JRNhV4fF du 13 avril 2022",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wlc-auth-bypass-JRNhV4fF"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-appnav-xe-dos-j5MXTR4 du 13 avril 2022",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-appnav-xe-dos-j5MXTR4"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-http-dos-svOdkdBS du 13 avril 2022",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http-dos-svOdkdBS"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-cgr1k-ap-dos-mSZR4QVh du 13 avril 2022",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cgr1k-ap-dos-mSZR4QVh"
}
]
}
CERTFR-2022-AVI-060
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits Cisco. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | ConfD | ConfD versions 6.4.x antérieures à 6.4.7.2 et 6.4.8 | ||
| Cisco | Firepower Threat Defense | Cisco Firepower Threat Defense (FTD) Software versions antérieures à 6.4.13 | ||
| Cisco | N/A | Cybervision Software versions antérieures à 4.0.2 | ||
| Cisco | IOS XR | Cisco IOS XR (64-bit) Software versions antérieures à 7.0.2, 7.1.1 | ||
| Cisco | N/A | Cisco Virtual Topology System (VTS) versions antérieures à 2.6.5 | ||
| Cisco | N/A | Cisco SD-WAN vEdge Routers versions antérieures à 18.4.4, 19.2.1, 19.3.0, 20.1.1 | ||
| Cisco | N/A | Cisco Carrier Packet Transport toutes versions (aucun correctif ne sera publié car le produit est en fin de vie) | ||
| Cisco | N/A | Cisco Enterprise NFV Infrastructure Software (NFVIS) versions antérieures à 3.12.1 | ||
| Cisco | ConfD | ConfD versions 6.7.x antérieures à 6.7.1 | ||
| Cisco | N/A | Cisco SD-WAN vSmart Software versions antérieures à 18.4.4, 19.2.1, 19.3.0, 20.1.1 | ||
| Cisco | ConfD | ConfD versions antérieures à 6.3.9.1 | ||
| Cisco | Firepower Threat Defense | Cisco Firepower Threat Defense (FTD) Software versions 6.7.x et 7.0.x antérieures à 7.0.1 | ||
| Cisco | N/A | Cisco Network Services Orchestrator (NSO) versions antérieures à 4.3.9.1, 4.4.5.6, 4.4.8, 4.5.7, 4.6.1.7, 4.6.2, 4.7.1, 5.1.0.1, 5.2 | ||
| Cisco | ConfD | ConfD versions 6.6.x antérieures à 6.6.2 | ||
| Cisco | SD-WAN vManage | Cisco SD-WAN vManage Software versions antérieures à 18.4.4, 19.2.1, 19.3.0, 20.1.1 | ||
| Cisco | N/A | Cisco Ultra Gateway Platform versions antérieures à 6.15.0 | ||
| Cisco | IOS XE | Cisco IOS XE SD-WAN versions antérieures à 16.10.2, 16.12.1b, 17.2.1r | ||
| Cisco | Meraki MX | Meraki MX Series Software toutes versions | ||
| Cisco | N/A | Cisco SD-WAN vBond Software versions antérieures à 18.4.4, 19.2.1, 19.3.0, 20.1.1 | ||
| Cisco | Firepower Threat Defense | Cisco Firepower Threat Defense (FTD) Software versions 6.5.x et 6.6.x antérieures à 6.6.5.1 | ||
| Cisco | N/A | Cisco RCM pour StarOS versions antérieures à 21.25.4 | ||
| Cisco | N/A | Cisco Network Convergence System (NCS) 4009, 4016 versions antérieures à 6.5.32 | ||
| Cisco | ConfD | ConfD versions 6.5.x antérieures à 6.5.7 |
References
| Title | Publication Time | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "ConfD versions 6.4.x ant\u00e9rieures \u00e0 6.4.7.2 et 6.4.8",
"product": {
"name": "ConfD",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Firepower Threat Defense (FTD) Software versions ant\u00e9rieures \u00e0 6.4.13",
"product": {
"name": "Firepower Threat Defense",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cybervision Software versions ant\u00e9rieures \u00e0 4.0.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR (64-bit) Software versions ant\u00e9rieures \u00e0 7.0.2, 7.1.1",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Virtual Topology System (VTS) versions ant\u00e9rieures \u00e0 2.6.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco SD-WAN vEdge Routers versions ant\u00e9rieures \u00e0 18.4.4, 19.2.1, 19.3.0, 20.1.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Carrier Packet Transport toutes versions (aucun correctif ne sera publi\u00e9 car le produit est en fin de vie)",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Enterprise NFV Infrastructure Software (NFVIS) versions ant\u00e9rieures \u00e0 3.12.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "ConfD versions 6.7.x ant\u00e9rieures \u00e0 6.7.1",
"product": {
"name": "ConfD",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco SD-WAN vSmart Software versions ant\u00e9rieures \u00e0 18.4.4, 19.2.1, 19.3.0, 20.1.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "ConfD versions ant\u00e9rieures \u00e0 6.3.9.1",
"product": {
"name": "ConfD",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Firepower Threat Defense (FTD) Software versions 6.7.x et 7.0.x ant\u00e9rieures \u00e0 7.0.1",
"product": {
"name": "Firepower Threat Defense",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Network Services Orchestrator (NSO) versions ant\u00e9rieures \u00e0 4.3.9.1, 4.4.5.6, 4.4.8, 4.5.7, 4.6.1.7, 4.6.2, 4.7.1, 5.1.0.1, 5.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "ConfD versions 6.6.x ant\u00e9rieures \u00e0 6.6.2",
"product": {
"name": "ConfD",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco SD-WAN vManage Software versions ant\u00e9rieures \u00e0 18.4.4, 19.2.1, 19.3.0, 20.1.1",
"product": {
"name": "SD-WAN vManage",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Ultra Gateway Platform versions ant\u00e9rieures \u00e0 6.15.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XE SD-WAN versions ant\u00e9rieures \u00e0 16.10.2, 16.12.1b, 17.2.1r",
"product": {
"name": "IOS XE",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Meraki MX Series Software toutes versions",
"product": {
"name": "Meraki MX",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco SD-WAN vBond Software versions ant\u00e9rieures \u00e0 18.4.4, 19.2.1, 19.3.0, 20.1.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Firepower Threat Defense (FTD) Software versions 6.5.x et 6.6.x ant\u00e9rieures \u00e0 6.6.5.1",
"product": {
"name": "Firepower Threat Defense",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco RCM pour StarOS versions ant\u00e9rieures \u00e0 21.25.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Network Convergence System (NCS) 4009, 4016 versions ant\u00e9rieures \u00e0 6.5.32",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "ConfD versions 6.5.x ant\u00e9rieures \u00e0 6.5.7",
"product": {
"name": "ConfD",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-20649",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20649"
},
{
"name": "CVE-2022-20655",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20655"
},
{
"name": "CVE-2022-20648",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20648"
},
{
"name": "CVE-2022-20685",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-20685"
}
],
"initial_release_date": "2022-01-20T00:00:00",
"last_revision_date": "2022-01-21T00:00:00",
"links": [],
"reference": "CERTFR-2022-AVI-060",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-01-20T00:00:00.000000"
},
{
"description": "Ajout de la CVE-2022-20648",
"revision_date": "2022-01-21T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Cisco.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance\net un contournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-cli-cmdinj-4MttWZPB du 19 janvier 2022",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cli-cmdinj-4MttWZPB"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-snort-dos-9D3hJLuj du 19 janvier 2022",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort-dos-9D3hJLuj"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-confdcli-cmdinj-wybQDSSh du 19 janvier 2022",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-confdcli-cmdinj-wybQDSSh"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-rcm-vuls-7cS3Nuq du 19 janvier 2022",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rcm-vuls-7cS3Nuq"
}
]
}
CERTFR-2021-AVI-691
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans Cisco IOS XR. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à l'intégrité des données et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | IOS XR | Cisco IOS XR versions 7.4.x antérieures à 7.4.1 | ||
| Cisco | IOS XR | Cisco IOS XR versions 6.2.3 à 7.1.2 sans le dernier correctif de sécurité | ||
| Cisco | IOS XR | Cisco IOS XR versions 6.7.x antérieures à 6.7.4 | ||
| Cisco | IOS XR | Cisco IOS XR versions 7.3.x antérieures à 7.3.2 | ||
| Cisco | IOS XR | Cisco IOS XR versions antérieures à 6.2.3 | ||
| Cisco | IOS XR | Cisco IOS XR versions 6.3.x antérieures à 6.3.3 | ||
| Cisco | IOS XR | Cisco IOS XR versions 6.4.x à 6.6.x antérieures à 6.6.3 | ||
| Cisco | IOS XR | Cisco IOS XR versions 7.x antérieures à 7.2.2 |
References
| Title | Publication Time | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Cisco IOS XR versions 7.4.x ant\u00e9rieures \u00e0 7.4.1",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR versions 6.2.3 \u00e0 7.1.2 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR versions 6.7.x ant\u00e9rieures \u00e0 6.7.4",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR versions 7.3.x ant\u00e9rieures \u00e0 7.3.2",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR versions ant\u00e9rieures \u00e0 6.2.3",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR versions 6.3.x ant\u00e9rieures \u00e0 6.3.3",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR versions 6.4.x \u00e0 6.6.x ant\u00e9rieures \u00e0 6.6.3",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR versions 7.x ant\u00e9rieures \u00e0 7.2.2",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2021-34719",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34719"
},
{
"name": "CVE-2021-34713",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34713"
},
{
"name": "CVE-2021-34720",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34720"
},
{
"name": "CVE-2021-34718",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34718"
},
{
"name": "CVE-2021-34728",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-34728"
}
],
"initial_release_date": "2021-09-09T00:00:00",
"last_revision_date": "2021-09-09T00:00:00",
"links": [],
"reference": "CERTFR-2021-AVI-691",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2021-09-09T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Cisco IOS XR.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni\nde service \u00e0 distance, une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es et une\natteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Cisco IOS XR",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-iosxr-privescal-dZYMrKf du 08 septembre 2021",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-privescal-dZYMrKf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-npspin-QYpwdhFD du 08 septembre 2021",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-npspin-QYpwdhFD"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ipsla-ZA3SRrpP du 08 septembre 2021",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipsla-ZA3SRrpP"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-iosxr-scp-inject-QwZOCv2 du 08 septembre 2021",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-scp-inject-QwZOCv2"
}
]
}
CERTFR-2021-AVI-082
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits Cisco. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à l'intégrité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | IOS XR | Les routeurs Cisco séries 8000 avec une version IOS XR 7.x antérieures à 7.2.1 | ||
| Cisco | IOS XR | Les routeurs Cisco séries 8000 avec une version IOS XR antérieures à 7.0.14 | ||
| Cisco | N/A | Les routeurs Cisco RV160, RV160W, RV260, RV260P et RV260W versions antérieures à 1.0.01.02 | ||
| Cisco | IOS XR | Cisco IOS XR versions 6.0.x antérieures à 6.0.2 | ||
| Cisco | IOS XR | Cisco IOS XR versions antérieures à 5.2.47 | ||
| Cisco | IOS XR | Les routeurs Cisco Network Convergence System séries 540 avec une version IOS XR 7.x antérieures à 7.2.1 | ||
| Cisco | IOS XR | Cisco IOS XR versions 5.3.x antérieures à 5.3.4 | ||
| Cisco | IOS XR | Cisco IOS XR versions antérieures à 6.7.3, 7.1.3, 7.2.2 et 7.3.1 | ||
| Cisco | N/A | Les routeurs Cisco RV016, RV042, RV042G et RV082 (ces produits sont en fin de vie et ne recevront plus de correctifs de sécurité) | ||
| Cisco | N/A | Les routeurs Cisco RV320 et RV325 Dual Gigabit WAN VPN versions antérieures à 1.5.1.13 |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Les routeurs Cisco s\u00e9ries 8000 avec une version IOS XR 7.x ant\u00e9rieures \u00e0 7.2.1",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Les routeurs Cisco s\u00e9ries 8000 avec une version IOS XR ant\u00e9rieures \u00e0 7.0.14",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Les routeurs Cisco RV160, RV160W, RV260, RV260P et RV260W versions ant\u00e9rieures \u00e0 1.0.01.02",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR versions 6.0.x ant\u00e9rieures \u00e0 6.0.2",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR versions ant\u00e9rieures \u00e0 5.2.47",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Les routeurs Cisco Network Convergence System s\u00e9ries 540 avec une version IOS XR 7.x ant\u00e9rieures \u00e0 7.2.1",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR versions 5.3.x ant\u00e9rieures \u00e0 5.3.4",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR versions ant\u00e9rieures \u00e0 6.7.3, 7.1.3, 7.2.2 et 7.3.1",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Les routeurs Cisco RV016, RV042, RV042G et RV082 (ces produits sont en fin de vie et ne recevront plus de correctifs de s\u00e9curit\u00e9)",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Les routeurs Cisco RV320 et RV325 Dual Gigabit WAN VPN versions ant\u00e9rieures \u00e0 1.5.1.13",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2021-1337",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1337"
},
{
"name": "CVE-2021-1268",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1268"
},
{
"name": "CVE-2021-1290",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1290"
},
{
"name": "CVE-2021-1370",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1370"
},
{
"name": "CVE-2021-1324",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1324"
},
{
"name": "CVE-2021-1329",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1329"
},
{
"name": "CVE-2021-1338",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1338"
},
{
"name": "CVE-2021-1339",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1339"
},
{
"name": "CVE-2021-1331",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1331"
},
{
"name": "CVE-2021-1295",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1295"
},
{
"name": "CVE-2021-1336",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1336"
},
{
"name": "CVE-2021-1328",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1328"
},
{
"name": "CVE-2021-1317",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1317"
},
{
"name": "CVE-2021-1293",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1293"
},
{
"name": "CVE-2021-1346",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1346"
},
{
"name": "CVE-2021-1321",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1321"
},
{
"name": "CVE-2021-1326",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1326"
},
{
"name": "CVE-2021-1244",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1244"
},
{
"name": "CVE-2021-1314",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1314"
},
{
"name": "CVE-2021-1344",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1344"
},
{
"name": "CVE-2021-1345",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1345"
},
{
"name": "CVE-2021-1313",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1313"
},
{
"name": "CVE-2021-1330",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1330"
},
{
"name": "CVE-2021-1322",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1322"
},
{
"name": "CVE-2021-1342",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1342"
},
{
"name": "CVE-2021-1288",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1288"
},
{
"name": "CVE-2021-1289",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1289"
},
{
"name": "CVE-2021-1348",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1348"
},
{
"name": "CVE-2021-1323",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1323"
},
{
"name": "CVE-2021-1335",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1335"
},
{
"name": "CVE-2021-1315",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1315"
},
{
"name": "CVE-2021-1294",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1294"
},
{
"name": "CVE-2021-1318",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1318"
},
{
"name": "CVE-2021-1136",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1136"
},
{
"name": "CVE-2021-1297",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1297"
},
{
"name": "CVE-2021-1319",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1319"
},
{
"name": "CVE-2021-1340",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1340"
},
{
"name": "CVE-2021-1325",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1325"
},
{
"name": "CVE-2021-1292",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1292"
},
{
"name": "CVE-2021-1332",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1332"
},
{
"name": "CVE-2021-1316",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1316"
},
{
"name": "CVE-2021-1333",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1333"
},
{
"name": "CVE-2021-1341",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1341"
},
{
"name": "CVE-2021-1296",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1296"
},
{
"name": "CVE-2021-1327",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1327"
},
{
"name": "CVE-2021-1320",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1320"
},
{
"name": "CVE-2021-1343",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1343"
},
{
"name": "CVE-2021-1334",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1334"
},
{
"name": "CVE-2021-1291",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1291"
},
{
"name": "CVE-2021-1347",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-1347"
}
],
"initial_release_date": "2021-02-04T00:00:00",
"last_revision_date": "2021-02-04T00:00:00",
"links": [],
"reference": "CERTFR-2021-AVI-082",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2021-02-04T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Cisco.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance\net une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-rv160-260-filewrite-7x9mnKjn du 03 f\u00e9vrier 2021",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv160-260-filewrite-7x9mnKjn"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-rv-overflow-ghZP68yj du 03 f\u00e9vrier 2021",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-overflow-ghZP68yj"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-iosxr-pe-QpzCAePe du 03 f\u00e9vrier 2021",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-pe-QpzCAePe"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-iosxr-dos-WwDdghs2 du 03 f\u00e9vrier 2021",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-dos-WwDdghs2"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-rv160-260-rce-XZeFkNHf du 03 f\u00e9vrier 2021",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv160-260-rce-XZeFkNHf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-rv-command-inject-BY4c5zd du 03 f\u00e9vrier 2021",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-rv-command-inject-BY4c5zd"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ioxr-l-zNhcGCBt du 03 f\u00e9vrier 2021",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ioxr-l-zNhcGCBt"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-xripv6-spJem78K du 03 f\u00e9vrier 2021",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xripv6-spJem78K"
}
]
}
CERTFR-2020-AVI-729
Vulnerability from certfr_avis
Une vulnérabilité a été découverte dans Cisco IOS XR. Elle permet à un attaquant de provoquer un déni de service à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | IOS XR | Cisco IOS XR version 6.4.2 sans le correctif de sécurité asr9k-px-6.4.2.CSCvv09115 sur les routeurs ASR9K-X64 | ||
| Cisco | IOS XR | Cisco IOS XR versions 6.7.x antérieures à 6.7.2 sur les routeurs de gamme ASR 9000 | ||
| Cisco | IOS XR | Cisco IOS XR version 6.4.2 sans le correctif de sécurité asr9k-px-6.4.2.CSCvv09115 sur les routeurs ASR9K-PX | ||
| Cisco | IOS XR | Cisco IOS XR versions 7.x antérieures à 7.1.2 sur les routeurs de gamme ASR 9000 | ||
| Cisco | IOS XR | Cisco IOS XR version 6.5.3 sans le correctif de sécurité asr9k-px-6.5.3.CSCvv09115 sur les routeurs ASR9K-PX |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Cisco IOS XR version 6.4.2 sans le correctif de s\u00e9curit\u00e9 asr9k-px-6.4.2.CSCvv09115 sur les routeurs ASR9K-X64",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR versions 6.7.x ant\u00e9rieures \u00e0 6.7.2 sur les routeurs de gamme ASR 9000",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR version 6.4.2 sans le correctif de s\u00e9curit\u00e9 asr9k-px-6.4.2.CSCvv09115 sur les routeurs ASR9K-PX",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR versions 7.x ant\u00e9rieures \u00e0 7.1.2 sur les routeurs de gamme ASR 9000",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR version 6.5.3 sans le correctif de s\u00e9curit\u00e9 asr9k-px-6.5.3.CSCvv09115 sur les routeurs ASR9K-PX",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2020-26070",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-26070"
}
],
"initial_release_date": "2020-11-12T00:00:00",
"last_revision_date": "2020-11-12T00:00:00",
"links": [],
"reference": "CERTFR-2020-AVI-729",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2020-11-12T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Cisco IOS XR. Elle permet \u00e0 un\nattaquant de provoquer un d\u00e9ni de service \u00e0 distance.\n",
"title": "Vuln\u00e9rabilit\u00e9 dans Cisco IOS XR",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-xr-cp-dos-ej8VB9QY du 10 novembre 2020",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xr-cp-dos-ej8VB9QY"
}
]
}
CERTFR-2020-AVI-611
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans Cisco IOS XR. Elles permettent à un attaquant de provoquer un déni de service à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | IOS XR | Les routeurs Cisco exécutant IOS XR et configurés pour accepter le protocole de routage multidiffusion à vecteur de distance (Distance Vector Multicast Routing Protocol, DVMRP). Se référer au bulletin de l'éditeur pour obtenir la liste des versions vulnérables. Ces vulnérabilités sont activement exploitées depuis la fin août 2020. |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Les routeurs Cisco ex\u00e9cutant IOS XR et configur\u00e9s pour accepter le protocole de routage multidiffusion \u00e0 vecteur de distance (Distance Vector Multicast Routing Protocol, DVMRP). Se r\u00e9f\u00e9rer au bulletin de l\u0027\u00e9diteur pour obtenir la liste des versions vuln\u00e9rables. Ces vuln\u00e9rabilit\u00e9s sont activement exploit\u00e9es depuis la fin ao\u00fbt 2020.",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2020-3569",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3569"
},
{
"name": "CVE-2020-3566",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3566"
}
],
"initial_release_date": "2020-09-30T00:00:00",
"last_revision_date": "2020-09-30T00:00:00",
"links": [],
"reference": "CERTFR-2020-AVI-611",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2020-09-30T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Cisco IOS XR. Elles\npermettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Cisco IOS XR",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-iosxr-dvmrp-memexh-dSmpdvfz du 29 ao\u00fbt 2020",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-dvmrp-memexh-dSmpdvfz"
}
]
}
CERTFR-2020-AVI-545
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits Cisco. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à l'intégrité des données et une élévation de privilèges.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | Jabber | Cisco Jabber pour Windows versions 12.8.x antérieures à 12.8.3 | ||
| Cisco | IOS XR | Cisco IOS XR versions 7.0.x et 7.1.x antérieures à 7.1.2 | ||
| Cisco | Jabber | Cisco Jabber pour Windows versions 12.1.x antérieures à 12.1.3 | ||
| Cisco | N/A | Routeurs Network Convergence System séries 6000 versions antérieures à 6.6.3, 7.0.2 et 7.1.1 | ||
| Cisco | N/A | Cisco Network Convergence System séries 4000 versions antérieures à SMU ID for 6.5.29 - AA17787 | ||
| Cisco | N/A | Cisco Network Convergence System séries 5500 versions antérieures à 6.6.3, 7.0.2 et 7.1.1 | ||
| Cisco | N/A | Cisco Enterprise NFVIS versions antérieures à 4.2.1 | ||
| Cisco | Jabber | Cisco Jabber pour Windows versions 12.9.x antérieures à 12.9.1 | ||
| Cisco | Jabber | Cisco Jabber pour Windows versions 12.7.x antérieures à 12.7.2 | ||
| Cisco | Jabber | Cisco Jabber pour Windows versions 12.5.x antérieures à 12.5.2 | ||
| Cisco | IOS | Routeurs Cisco IOS XRv 9000 versions antérieures à 6.6.3, 7.0.2 et 7.1.1 | ||
| Cisco | N/A | Routeurs Network Convergence System 540 versions antérieures à 6.6.3, 7.0.2 et 7.1.1 | ||
| Cisco | Jabber | Cisco Jabber pour Windows versions 12.6.x antérieures à 12.6.3 | ||
| Cisco | N/A | Routeurs Cisco de gamme 8000 versions antérieures à 7.0.12 et 7.2.1 | ||
| Cisco | N/A | Routeurs Network Convergence System 560 versions antérieures à 6.6.3, 7.0.2 et 7.1.1 | ||
| Cisco | IOS XR | Cisco IOS XR SW versions antérieures à 7.0.2 et 7.1.1 |
References
| Title | Publication Time | Tags | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Cisco Jabber pour Windows versions 12.8.x ant\u00e9rieures \u00e0 12.8.3",
"product": {
"name": "Jabber",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR versions 7.0.x et 7.1.x ant\u00e9rieures \u00e0 7.1.2",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Jabber pour Windows versions 12.1.x ant\u00e9rieures \u00e0 12.1.3",
"product": {
"name": "Jabber",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Routeurs Network Convergence System s\u00e9ries 6000 versions ant\u00e9rieures \u00e0 6.6.3, 7.0.2 et 7.1.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Network Convergence System s\u00e9ries 4000 versions ant\u00e9rieures \u00e0 SMU ID for 6.5.29 - AA17787",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Network Convergence System s\u00e9ries 5500 versions ant\u00e9rieures \u00e0 6.6.3, 7.0.2 et 7.1.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Enterprise NFVIS versions ant\u00e9rieures \u00e0 4.2.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Jabber pour Windows versions 12.9.x ant\u00e9rieures \u00e0 12.9.1",
"product": {
"name": "Jabber",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Jabber pour Windows versions 12.7.x ant\u00e9rieures \u00e0 12.7.2",
"product": {
"name": "Jabber",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Jabber pour Windows versions 12.5.x ant\u00e9rieures \u00e0 12.5.2",
"product": {
"name": "Jabber",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Routeurs Cisco IOS XRv 9000 versions ant\u00e9rieures \u00e0 6.6.3, 7.0.2 et 7.1.1",
"product": {
"name": "IOS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Routeurs Network Convergence System 540 versions ant\u00e9rieures \u00e0 6.6.3, 7.0.2 et 7.1.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Jabber pour Windows versions 12.6.x ant\u00e9rieures \u00e0 12.6.3",
"product": {
"name": "Jabber",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Routeurs Cisco de gamme 8000 versions ant\u00e9rieures \u00e0 7.0.12 et 7.2.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Routeurs Network Convergence System 560 versions ant\u00e9rieures \u00e0 6.6.3, 7.0.2 et 7.1.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR SW versions ant\u00e9rieures \u00e0 7.0.2 et 7.1.1",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2020-3530",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3530"
},
{
"name": "CVE-2020-3495",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3495"
},
{
"name": "CVE-2020-3478",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3478"
},
{
"name": "CVE-2020-3430",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3430"
},
{
"name": "CVE-2020-3473",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3473"
}
],
"initial_release_date": "2020-09-03T00:00:00",
"last_revision_date": "2020-09-03T00:00:00",
"links": [],
"reference": "CERTFR-2020-AVI-545",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2020-09-03T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Cisco.\nElles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code\narbitraire \u00e0 distance, une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es et une\n\u00e9l\u00e9vation de privil\u00e8ges.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-jabber-UyTKCPGg du 02 septembre 2020",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-jabber-UyTKCPGg"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-iosxr-cli-privescl-sDVEmhqv du 02 septembre 2020",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-cli-privescl-sDVEmhqv"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-iosxr-LJtNFjeN du 02 septembre 2020",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-LJtNFjeN"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-jabber-vY8M4KGB du 02 septembre 2020",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-jabber-vY8M4KGB"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-nfvis-file-overwrite-UONzPMkr du 02 septembre 2020",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nfvis-file-overwrite-UONzPMkr"
}
]
}
CERTFR-2020-AVI-340
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits Cisco. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | N/A | Cisco IOx sans le dernier correctif de sécurité (voir le site du constructeur pour la liste des produits vulnérables) | ||
| Cisco | IOS | Cisco IOS pour routeurs Cisco séries CGR1000 sans le dernier correctif de sécurité | ||
| Cisco | NX-OS | Cisco NX-OS sans le dernier correctif de sécurité (voir le site du constructeur pour la liste des produits vulnérables) | ||
| Cisco | IOS XE | Cisco IOS et IOS XE sans le dernier correctif de sécurité (voir le site du constructeur pour la liste des produits vulnérables) | ||
| Cisco | IOS | Cisco IOS pour routeurs Cisco 809 et 829 (Industrial ISRs) sans le dernier correctif de sécurité | ||
| Cisco | IOS XR | Cisco IOS XR versions 5.2 et 5.3 |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Cisco IOx sans le dernier correctif de s\u00e9curit\u00e9 (voir le site du constructeur pour la liste des produits vuln\u00e9rables)",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS pour routeurs Cisco s\u00e9ries CGR1000 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "IOS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco NX-OS sans le dernier correctif de s\u00e9curit\u00e9 (voir le site du constructeur pour la liste des produits vuln\u00e9rables)",
"product": {
"name": "NX-OS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS et IOS XE sans le dernier correctif de s\u00e9curit\u00e9 (voir le site du constructeur pour la liste des produits vuln\u00e9rables)",
"product": {
"name": "IOS XE",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS pour routeurs Cisco 809 et 829 (Industrial ISRs) sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "IOS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR versions 5.2 et 5.3",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2020-3211",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3211"
},
{
"name": "CVE-2020-3257",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3257"
},
{
"name": "CVE-2020-3212",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3212"
},
{
"name": "CVE-2020-3205",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3205"
},
{
"name": "CVE-2020-3218",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3218"
},
{
"name": "CVE-2020-3200",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3200"
},
{
"name": "CVE-2020-3234",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3234"
},
{
"name": "CVE-2020-3229",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3229"
},
{
"name": "CVE-2020-3217",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3217"
},
{
"name": "CVE-2020-3208",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3208"
},
{
"name": "CVE-2020-3235",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3235"
},
{
"name": "CVE-2020-3219",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3219"
},
{
"name": "CVE-2020-3230",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3230"
},
{
"name": "CVE-2020-3209",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3209"
},
{
"name": "CVE-2020-3258",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3258"
},
{
"name": "CVE-2020-3199",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3199"
},
{
"name": "CVE-2020-3227",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3227"
},
{
"name": "CVE-2020-3203",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3203"
},
{
"name": "CVE-2020-3210",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3210"
},
{
"name": "CVE-2020-3198",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3198"
},
{
"name": "CVE-2020-3225",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3225"
},
{
"name": "CVE-2020-3224",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3224"
},
{
"name": "CVE-2020-3238",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3238"
},
{
"name": "CVE-2020-3221",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3221"
}
],
"initial_release_date": "2020-06-04T00:00:00",
"last_revision_date": "2020-06-05T00:00:00",
"links": [],
"reference": "CERTFR-2020-AVI-340",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2020-06-04T00:00:00.000000"
},
{
"description": "Correction de la date de certains avis.",
"revision_date": "2020-06-05T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Cisco.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance\net un contournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ios-iot-vds-cmd-inj-VfJtqGhE du 03 juin 2020",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-iot-vds-cmd-inj-VfJtqGhE"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-iosxe-digsig-bypass-FYQ3bmVq du 03 juin 2020",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-digsig-bypass-FYQ3bmVq"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ios-iot-udp-vds-inj-f2D5Jzrt du 03 juin 2020",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-iot-udp-vds-inj-f2D5Jzrt"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ios-iot-vds-cred-uPMp9zbY du 03 juin 2020",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-iot-vds-cred-uPMp9zbY"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-iosxe-fnfv9-dos-HND6Fc9u du 03 juin 2020",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-fnfv9-dos-HND6Fc9u"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-sip-Cv28sQw2 du 03 juin 2020",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sip-Cv28sQw2"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-webui-cmdinj-zM283Zdw du 03 juin 2020",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-cmdinj-zM283Zdw"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ioxPE-KgGvCAf9 du 03 juin 2020",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ioxPE-KgGvCAf9"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-web-cmdinj2-fOnjk2LD du 03 juin 2020",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-web-cmdinj2-fOnjk2LD"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-caf-3dXM8exv du 03 juin 2020",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-caf-3dXM8exv"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-snmp-dos-USxSyTk5 du 03 juin 2020",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snmp-dos-USxSyTk5"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ngwc-cmdinj-KEwWVWR du 03 juin 2020",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ngwc-cmdinj-KEwWVWR"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-iosxe-webui-rce-uk8BXcUD du 03 juin 2020",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-webui-rce-uk8BXcUD"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-cipdos-hkfTZXEx du 03 juin 2020",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cipdos-hkfTZXEx"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-web-cmdinj4-S2TmH7GA du 03 juin 2020",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-web-cmdinj4-S2TmH7GA"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ios-nxos-onepk-rce-6Hhyt4dC du 03 juin 2020",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-nxos-onepk-rce-6Hhyt4dC"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-webui-PZgQxjfG du 03 juin 2020",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-PZgQxjfG"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-iosxe-ewlc-dos-TkuPVmZN du 03 juin 2020",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-ewlc-dos-TkuPVmZN"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-web-cmdinj3-44st5CcA du 03 juin 2020",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-web-cmdinj3-44st5CcA"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ios-iot-gos-vuln-s9qS8kYL du 03 juin 2020",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-iot-gos-vuln-s9qS8kYL"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ssh-dos-Un22sd2A du 03 juin 2020",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ssh-dos-Un22sd2A"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ikev2-9p23Jj2a du 03 juin 2020",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ikev2-9p23Jj2a"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ios-iot-rce-xYRSeMNH du 03 juin 2020",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-iot-rce-xYRSeMNH"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-ios-ir800-img-verif-wHhLYHjK du 03 juin 2020",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-ir800-img-verif-wHhLYHjK"
}
]
}
CERTFR-2020-AVI-073
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits Cisco. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et un déni de service à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | N/A | IP Conference Phone 8832 versions antérieures à 12.7(1) | ||
| Cisco | N/A | IP Conference Phone 7832 avec microgiciel multi-plateformes versions antérieures à 11.3(1)SR1 | ||
| Cisco | N/A | Cisco FXOS, IOS XR, et NX-OS (se référer au bulletin de sécurité de l'éditeur cisco-sa-20200205-fxnxos-iosxr-cdp-dos, cf. section Documentation) | ||
| Cisco | N/A | Unified IP Conference Phone 8831 for Third-Party Call Control | ||
| Cisco | IP Phone | IP Phone 8811, 8841, 8851, 8861, 8845 et 8865 Desktop Phones versions antérieures à 12.7(1) | ||
| Cisco | NX-OS | Cisco NX-OS versions antérieures à 7.0(3)I7(8) (disponible en février 2020) | ||
| Cisco | IP Phone | IP Phone 6821, 6841, 6851, 6861 et 6871 avec microgiciel multi-plateformes versions antérieures à 11.3(1)SR1 | ||
| Cisco | IOS XR | Cisco IOS XR versions 7.0.x antérieures à 7.0.2 (disponible en mars 2020) | ||
| Cisco | N/A | IP Conference Phone 7832 versions antérieures à 12.7(1) | ||
| Cisco | IP Phone | Wireless IP Phone 8821 et 8821-EX versions antérieures à 11.0(5)SR2 | ||
| Cisco | IP Phone | IP Phone 8811, 8841, 8851, 8861, 8845 et 8865 Desktop Phones avec microgiciel multi-plateformes versions antérieures à 11.3(1)SR1 | ||
| Cisco | IP Phone | IP Phone 7811, 7821, 7841 et 7861 Desktop Phones avec microgiciel multi-plateformes versions antérieures à 11.3(1)SR1 | ||
| Cisco | IP Phone | IP Phone 7811, 7821, 7841 et 7861 Desktop Phones versions antérieures à 12.7(1) | ||
| Cisco | NX-OS | Cisco NX-OS versions7.0(3)F, 9.2 et 9.3 antérieures à 9.3(2) | ||
| Cisco | IOS XR | Cisco IOS XR versions 5.2.5, 6.4.2, 6.5.3, 6.6.12, 6.6.25 et 7.0.1 sans le dernier correctif de sécurité (se référer au bulletin de sécurité de l'éditeurcisco-sa-20200205-iosxr-cdp-rce, cf. section Documentation) | ||
| Cisco | IOS XR | Cisco IOS XR versions antérieures à 6.6.3 | ||
| Cisco | N/A | Unified IP Conference Phone 8831 versions antérieures à 10.3(1)SR6 (disponible en mars 2020) | ||
| Cisco | N/A | Cisco Video Surveillance 8000 Series IP Cameras versions antérieures à 1.0.7 | ||
| Cisco | N/A | IP Conference Phone 8832 avec microgiciel multi-plateformes versions antérieures à 11.3(1)SR1 |
References
| Title | Publication Time | Tags | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "IP Conference Phone 8832 versions ant\u00e9rieures \u00e0 12.7(1)",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IP Conference Phone 7832 avec microgiciel multi-plateformes versions ant\u00e9rieures \u00e0 11.3(1)SR1",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco FXOS, IOS XR, et NX-OS (se r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur cisco-sa-20200205-fxnxos-iosxr-cdp-dos, cf. section Documentation)",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Unified IP Conference Phone 8831 for Third-Party Call Control",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IP Phone 8811, 8841, 8851, 8861, 8845 et 8865 Desktop Phones versions ant\u00e9rieures \u00e0 12.7(1)",
"product": {
"name": "IP Phone",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco NX-OS versions ant\u00e9rieures \u00e0 7.0(3)I7(8) (disponible en f\u00e9vrier 2020)",
"product": {
"name": "NX-OS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IP Phone 6821, 6841, 6851, 6861 et 6871 avec microgiciel multi-plateformes versions ant\u00e9rieures \u00e0 11.3(1)SR1",
"product": {
"name": "IP Phone",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR versions 7.0.x ant\u00e9rieures \u00e0 7.0.2 (disponible en mars 2020)",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IP Conference Phone 7832 versions ant\u00e9rieures \u00e0 12.7(1)",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Wireless IP Phone 8821 et 8821-EX versions ant\u00e9rieures \u00e0 11.0(5)SR2",
"product": {
"name": "IP Phone",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IP Phone 8811, 8841, 8851, 8861, 8845 et 8865 Desktop Phones avec microgiciel multi-plateformes versions ant\u00e9rieures \u00e0 11.3(1)SR1",
"product": {
"name": "IP Phone",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IP Phone 7811, 7821, 7841 et 7861 Desktop Phones avec microgiciel multi-plateformes versions ant\u00e9rieures \u00e0 11.3(1)SR1",
"product": {
"name": "IP Phone",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IP Phone 7811, 7821, 7841 et 7861 Desktop Phones versions ant\u00e9rieures \u00e0 12.7(1)",
"product": {
"name": "IP Phone",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco NX-OS versions7.0(3)F, 9.2 et 9.3 ant\u00e9rieures \u00e0 9.3(2)",
"product": {
"name": "NX-OS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR versions 5.2.5, 6.4.2, 6.5.3, 6.6.12, 6.6.25 et 7.0.1 sans le dernier correctif de s\u00e9curit\u00e9 (se r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteurcisco-sa-20200205-iosxr-cdp-rce, cf. section Documentation)",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR versions ant\u00e9rieures \u00e0 6.6.3",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Unified IP Conference Phone 8831 versions ant\u00e9rieures \u00e0 10.3(1)SR6 (disponible en mars 2020)",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Video Surveillance 8000 Series IP Cameras versions ant\u00e9rieures \u00e0 1.0.7",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "IP Conference Phone 8832 avec microgiciel multi-plateformes versions ant\u00e9rieures \u00e0 11.3(1)SR1",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2020-3111",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3111"
},
{
"name": "CVE-2020-3119",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3119"
},
{
"name": "CVE-2020-3110",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3110"
},
{
"name": "CVE-2020-3118",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3118"
},
{
"name": "CVE-2020-3120",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3120"
}
],
"initial_release_date": "2020-02-06T00:00:00",
"last_revision_date": "2020-02-06T00:00:00",
"links": [],
"reference": "CERTFR-2020-AVI-073",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2020-02-06T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Cisco.\nElles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code\narbitraire \u00e0 distance et un d\u00e9ni de service \u00e0 distance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20200205-nxos-cdp-rce du 05 f\u00e9vrier 2020",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200205-nxos-cdp-rce"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20200205-voip-phones-rce-dos du 05 f\u00e9vrier 2020",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200205-voip-phones-rce-dos"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20200205-iosxr-cdp-rce du 05 f\u00e9vrier 2020",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200205-iosxr-cdp-rce"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20200205-ipcameras-rce-dos du 05 f\u00e9vrier 2020",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200205-ipcameras-rce-dos"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20200205-fxnxos-iosxr-cdp-dos du 05 f\u00e9vrier 2020",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200205-fxnxos-iosxr-cdp-dos"
}
]
}
CERTFR-2020-AVI-055
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits Cisco. Elles permettent à un attaquant de provoquer un déni de service à distance, un contournement de la politique de sécurité et une élévation de privilèges.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | N/A | Cisco Firepower Management Center (FMC) versions 6.4.x antérieures à 6.4.0.7 | ||
| Cisco | N/A | Cisco TC versions 7.x (CSCvs67675) antérieures à 7.3.20 | ||
| Cisco | N/A | Cisco Firepower Management Center (FMC) versions 6.3.x antérieures à 6.3.0.6 (correctif disponible en mai 2020) | ||
| Cisco | IOS XE | Cisco IOS XE SD-WAN versions antérieures à 16.12.1 | ||
| Cisco | N/A | Cisco CE versions 9.x (CSCvs45241, CSCvs67680) antérieures à 9.8.3 | ||
| Cisco | Smart Software Manager | Cisco Smart Software Manager On-Prem versions antérieures à 7-201910 | ||
| Cisco | N/A | Cisco Firepower Management Center (FMC) versions antérieures à 6.2.3.16 (correctif disponible en février 2020) | ||
| Cisco | IOS XR | Cisco IOS XR (se référer au bulletin de l'éditeur pour la liste des correctifs disponibles, cf. section Documentation) | ||
| Cisco | N/A | Cisco CE versions 9.10.x (CSCvs45241, CSCvs67680) antérieures à 9.10.0 | ||
| Cisco | N/A | Cisco CE versions 9.9.x (CSCvs45241, CSCvs67680) antérieures à 9.9.2 | ||
| Cisco | N/A | Cisco CE versions 8.x (CSCvs45241, CSCvs67680) antérieures à 8.3.8 | ||
| Cisco | N/A | Cisco SD-WAN Solution vManage versions antérieures à 18.4.302 | ||
| Cisco | N/A | Cisco Firepower Management Center (FMC) versions 6.5.x antérieures à 6.5.0.2 |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Cisco Firepower Management Center (FMC) versions 6.4.x ant\u00e9rieures \u00e0 6.4.0.7",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco TC versions 7.x (CSCvs67675) ant\u00e9rieures \u00e0 7.3.20",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Firepower Management Center (FMC) versions 6.3.x ant\u00e9rieures \u00e0 6.3.0.6 (correctif disponible en mai 2020)",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XE SD-WAN versions ant\u00e9rieures \u00e0 16.12.1",
"product": {
"name": "IOS XE",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco CE versions 9.x (CSCvs45241, CSCvs67680) ant\u00e9rieures \u00e0 9.8.3",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Smart Software Manager On-Prem versions ant\u00e9rieures \u00e0 7-201910",
"product": {
"name": "Smart Software Manager",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Firepower Management Center (FMC) versions ant\u00e9rieures \u00e0 6.2.3.16 (correctif disponible en f\u00e9vrier 2020)",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR (se r\u00e9f\u00e9rer au bulletin de l\u0027\u00e9diteur pour la liste des correctifs disponibles, cf. section Documentation)",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco CE versions 9.10.x (CSCvs45241, CSCvs67680) ant\u00e9rieures \u00e0 9.10.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco CE versions 9.9.x (CSCvs45241, CSCvs67680) ant\u00e9rieures \u00e0 9.9.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco CE versions 8.x (CSCvs45241, CSCvs67680) ant\u00e9rieures \u00e0 8.3.8",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco SD-WAN Solution vManage versions ant\u00e9rieures \u00e0 18.4.302",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Firepower Management Center (FMC) versions 6.5.x ant\u00e9rieures \u00e0 6.5.0.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2019-16027",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-16027"
},
{
"name": "CVE-2019-16028",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-16028"
},
{
"name": "CVE-2019-16019",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-16019"
},
{
"name": "CVE-2019-16029",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-16029"
},
{
"name": "CVE-2019-1950",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1950"
},
{
"name": "CVE-2020-3115",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3115"
},
{
"name": "CVE-2019-16022",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-16022"
},
{
"name": "CVE-2019-16018",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-16018"
},
{
"name": "CVE-2019-16020",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-16020"
},
{
"name": "CVE-2019-16021",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-16021"
},
{
"name": "CVE-2020-3143",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-3143"
},
{
"name": "CVE-2019-16023",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-16023"
}
],
"initial_release_date": "2020-01-23T00:00:00",
"last_revision_date": "2020-01-23T00:00:00",
"links": [],
"reference": "CERTFR-2020-AVI-055",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2020-01-23T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Cisco.\nElles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0\ndistance, un contournement de la politique de s\u00e9curit\u00e9 et une \u00e9l\u00e9vation\nde privil\u00e8ges.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-telepresence-path-tr-wdrnYEZZ du 22 janvier 2020",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-telepresence-path-tr-wdrnYEZZ"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20200122-fmc-auth du 22 janvier 2020",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200122-fmc-auth"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20200122-ios-xr-evpn du 22 janvier 2020",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200122-ios-xr-evpn"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-sd-wan-cred-EVGSF259 du 22 janvier 2020",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-cred-EVGSF259"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20200122-ios-xr-routes du 22 janvier 2020",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200122-ios-xr-routes"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20200122-sdwan-priv-esc du 22 janvier 2020",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200122-sdwan-priv-esc"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20200122-on-prem-dos du 22 janvier 2020",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200122-on-prem-dos"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20200122-ios-xr-dos du 22 janvier 2020",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200122-ios-xr-dos"
}
]
}
CERTFR-2019-AVI-406
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans Cisco IOS XR. Elles permettent à un attaquant de provoquer un déni de service à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Cisco IOS XR version 6.6.1 sur NC56K sans le correctif de s\u00e9curit\u00e9 ncs6k-6.6.1.CSCvq45118.tar",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR version 6.5.3 sur ASR9000 sans le correctif de s\u00e9curit\u00e9 asr9k-px-6.5.3.CSCvq45118",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2019-1910",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1910"
},
{
"name": "CVE-2019-1918",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1918"
}
],
"initial_release_date": "2019-08-21T00:00:00",
"last_revision_date": "2019-08-21T00:00:00",
"links": [],
"reference": "CERTFR-2019-AVI-406",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2019-08-21T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Cisco IOS XR. Elles\npermettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Cisco IOS XR",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190807-iosxr-isis-dos-1918 du 07 ao\u00fbt 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-iosxr-isis-dos-1918"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190807-iosxr-isis-dos-1910 du 07 ao\u00fbt 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-iosxr-isis-dos-1910"
}
]
}
CERTFR-2019-AVI-377
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits Cisco. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | IOS XR | Cisco IOS XR version 6.6.1 sans le correctif de sécurité ncs6k-6.6.1.CSCvq45118.tar sur NC56K | ||
| Cisco | N/A | Cisco ASA versions 9.10.x antérieures à 9.10.1.22 | ||
| Cisco | IOS XR | Cisco IOS XR version 6.5.3 sans le correctif de sécurité asr9k-px-6.5.3.CSCvq45118 sur ASR9000 | ||
| Cisco | N/A | Webex Business Suite WBS versions 39.5.x antérieures à 3.5.5 | ||
| Cisco | N/A | Cisco ASA versions 9.5.x et 9.6.x antérieures à 9.6.4.30 | ||
| Cisco | N/A | Webex Business Suite WBS versions antérieures à 39.6.0 | ||
| Cisco | N/A | Cisco Enterprise NFVIS versions antérieures à 3.12.1 | ||
| Cisco | N/A | Webex Meetings Server versions antérieures à 4.0MR1 | ||
| Cisco | N/A | Cisco ASA versions 9.9.x antérieures à 9.9.2.50 | ||
| Cisco | N/A | Cisco ASA versions antérieures à 9.4.4.37 | ||
| Cisco | N/A | Cisco ASA versions 9.7.x et 9.8.x antérieures à 9.8.4.7 | ||
| Cisco | N/A | Cisco ASA versions 9.12.x antérieures à 9.12.2 | ||
| Cisco | IOS XR | Cisco IOS XR versions antérieures à 6.6.3 | ||
| Cisco | N/A | Webex Meetings Online versions antérieures à 1.3.43 |
References
| Title | Publication Time | Tags | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Cisco IOS XR version 6.6.1 sans le correctif de s\u00e9curit\u00e9 ncs6k-6.6.1.CSCvq45118.tar sur NC56K",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco ASA versions 9.10.x ant\u00e9rieures \u00e0 9.10.1.22",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR version 6.5.3 sans le correctif de s\u00e9curit\u00e9 asr9k-px-6.5.3.CSCvq45118 sur ASR9000",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Webex Business Suite WBS versions 39.5.x ant\u00e9rieures \u00e0 3.5.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco ASA versions 9.5.x et 9.6.x ant\u00e9rieures \u00e0 9.6.4.30",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Webex Business Suite WBS versions ant\u00e9rieures \u00e0 39.6.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Enterprise NFVIS versions ant\u00e9rieures \u00e0 3.12.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Webex Meetings Server versions ant\u00e9rieures \u00e0 4.0MR1",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco ASA versions 9.9.x ant\u00e9rieures \u00e0 9.9.2.50",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco ASA versions ant\u00e9rieures \u00e0 9.4.4.37",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco ASA versions 9.7.x et 9.8.x ant\u00e9rieures \u00e0 9.8.4.7",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco ASA versions 9.12.x ant\u00e9rieures \u00e0 9.12.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR versions ant\u00e9rieures \u00e0 6.6.3",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Webex Meetings Online versions ant\u00e9rieures \u00e0 1.3.43",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2019-1928",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1928"
},
{
"name": "CVE-2019-1925",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1925"
},
{
"name": "CVE-2019-1926",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1926"
},
{
"name": "CVE-2019-1910",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1910"
},
{
"name": "CVE-2019-1895",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1895"
},
{
"name": "CVE-2019-1924",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1924"
},
{
"name": "CVE-2019-1934",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1934"
},
{
"name": "CVE-2019-1918",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1918"
},
{
"name": "CVE-2019-1927",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1927"
},
{
"name": "CVE-2019-1929",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1929"
}
],
"initial_release_date": "2019-08-08T00:00:00",
"last_revision_date": "2019-08-08T00:00:00",
"links": [],
"reference": "CERTFR-2019-AVI-377",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2019-08-08T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Cisco.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance\net un contournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190807-nfvis-vnc-authbypass du 07 ao\u00fbt 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-nfvis-vnc-authbypass"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190807-webex-player du 07 ao\u00fbt 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-webex-player"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190807-iosxr-isis-dos-1918 du 07 ao\u00fbt 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-iosxr-isis-dos-1918"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190807-iosxr-isis-dos-1910 du 07 ao\u00fbt 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-iosxr-isis-dos-1910"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190807-asa-privescala du 07 ao\u00fbt 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-asa-privescala"
}
]
}
CERTFR-2019-AVI-228
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits Cisco. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | NX-OS | Cisco NX-OS versions antérieures à 6.2(10) sur Nexus 7000 et 7700 Series Switches | ||
| Cisco | NX-OS | Cisco NX-OS versions 14.1(x) antérieures à 14.1(1i) sur Nexus 9000 Series Fabric Switches Mode ACI | ||
| Cisco | N/A | Webex Network Recording Player versions antérieures à Version 2.8MR3 SecurityPatch2, 3.0MR2 SecurityPatch2 ou 4.0 sur Cisco Webex Meetings Server | ||
| Cisco | Small Business | Small Business Sx250, Sx350, Sx550 Series Switches versions antérieures à 2.5.0.78 | ||
| Cisco | N/A | Cisco PI Software versions antérieures à 3.4.1, 3.5 et 3.6 | ||
| Cisco | N/A | Cisco FXOS versions 2.4.x antérieures à 2.4.1.222 sur Firepower 4100 Series et Firepower 9300 Security Appliances | ||
| Cisco | IOS XR | Cisco IOS XR versions antérieures à 5.3.3 Service Pack 11 | ||
| Cisco | IOS XR | Cisco IOS XR versions 6.6.x antérieures à 6.6.12 | ||
| Cisco | NX-OS | Cisco NX-OS versions 7.0.x antérieures à 7.0(3)I7(2) sur Nexus 3500 Platform Switches | ||
| Cisco | NX-OS | Cisco NX-OS versions 7.0(3).x antérieures à 7.0(3)F3(1) sur Nexus 9500 R-Series Switching Platform | ||
| Cisco | IOS XR | Cisco IOS XR versions 6.4.x antérieures à 6.4.2 | ||
| Cisco | NX-OS | Cisco NX-OS versions antérieures à 14.0(2c) sur Nexus 9000 Series Fabric Switches Mode ACI | ||
| Cisco | Small Business | Small Business Sx200, Sx300, Sx500 et ESW2 Series Managed Switches versions antérieures à 1.4.10.6 | ||
| Cisco | N/A | Cisco FXOS versions antérieures à 2.2.2.91 sur Firepower 4100 Series et Firepower 9300 Security Appliances | ||
| Cisco | NX-OS | Cisco NX-OS versions antérieures à 6.2(11) sur MDS 9000 Series Multilayer Switches | ||
| Cisco | NX-OS | Cisco NX-OS versions antérieures à 7.1(5)N1(1b) sur Nexus 5500, 5600 et 6000 Series Switches | ||
| Cisco | NX-OS | Cisco NX-OS versions 7.0(3)I7(x) antérieures à 7.0(3)I7(2) sur Nexus 3000 Series Switches et Nexus 9000 Series Switches en Standalone NX-OS Mode | ||
| Cisco | N/A | Cisco FXOS versions 2.6.x antérieures à 2.6.1.131 sur Firepower 4100 Series et Firepower 9300 Security Appliances | ||
| Cisco | IOS XR | Cisco IOS XR versions 6.3.x antérieures à 6.3.3 | ||
| Cisco | N/A | EPN Manager versions antérieures à 3.0.1 | ||
| Cisco | NX-OS | Cisco NX-OS versions antérieures à 5.2(1)SM3(2.1) sur Nexus 1000V Switch for Microsoft Hyper-V | ||
| Cisco | NX-OS | Cisco NX-OS versions 7.3.x antérieures à 7.3(4)N1(1a) sur Nexus 5500, 5600 et 6000 Series Switches | ||
| Cisco | N/A | Webex Network Recording Player et Webex Player versions antérieures à Version 1.3.42 sur Cisco Webex Meetings Online | ||
| Cisco | IOS XR | Cisco IOS XR versions 6.1.x, 6.2.x et 6.5.x antérieures à 6.5.3 | ||
| Cisco | N/A | Cisco Video Surveillance Manager versions antérieures à 7.12.1 | ||
| Cisco | NX-OS | Cisco NX-OS versions 8.0.x antérieures à 8.1(1) sur Nexus 7000 et 7700 Series Switches | ||
| Cisco | NX-OS | Cisco NX-OS versions antérieures à 6.0(2)A8(4) sur Nexus 3500 Platform Switches | ||
| Cisco | NX-OS | Cisco NX-OS versions 8.1(x) antérieures à 8.1(1) sur MDS 9000 Series Multilayer Switches | ||
| Cisco | N/A | Cisco FXOS versions 2.3.x antérieures à 2.3.1.130 sur Firepower 4100 Series et Firepower 9300 Security Appliances | ||
| Cisco | N/A | Webex Network Recording Player et Webex Player versions antérieures à WBS39.2.205 sur Cisco Webex Business Suite sites | ||
| Cisco | NX-OS | Cisco NX-OS versions antérieures à 7.0(3)I4(8) sur Nexus 3000 Series Switches et Nexus 9000 Series Switches en Standalone NX-OS Mode | ||
| Cisco | NX-OS | Cisco NX-OS versions antérieures à 5.2(1)SV3(4.1a) sur Nexus 1000V Switch for VMware vSphere | ||
| Cisco | NX-OS | Cisco NX-OS versions 7.2.x antérieures à 7.2(0)D1(1) sur Nexus 7000 et 7700 Series Switches |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Cisco NX-OS versions ant\u00e9rieures \u00e0 6.2(10) sur Nexus 7000 et 7700 Series Switches",
"product": {
"name": "NX-OS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco NX-OS versions 14.1(x) ant\u00e9rieures \u00e0 14.1(1i) sur Nexus 9000 Series Fabric Switches Mode ACI",
"product": {
"name": "NX-OS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Webex Network Recording Player versions ant\u00e9rieures \u00e0 Version 2.8MR3 SecurityPatch2, 3.0MR2 SecurityPatch2 ou 4.0 sur Cisco Webex Meetings Server",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Small Business Sx250, Sx350, Sx550 Series Switches versions ant\u00e9rieures \u00e0 2.5.0.78",
"product": {
"name": "Small Business",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco PI Software versions ant\u00e9rieures \u00e0 3.4.1, 3.5 et 3.6",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco FXOS versions 2.4.x ant\u00e9rieures \u00e0 2.4.1.222 sur Firepower 4100 Series et Firepower 9300 Security Appliances",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR versions ant\u00e9rieures \u00e0 5.3.3 Service Pack 11",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR versions 6.6.x ant\u00e9rieures \u00e0 6.6.12",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco NX-OS versions 7.0.x ant\u00e9rieures \u00e0 7.0(3)I7(2) sur Nexus 3500 Platform Switches",
"product": {
"name": "NX-OS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco NX-OS versions 7.0(3).x ant\u00e9rieures \u00e0 7.0(3)F3(1) sur Nexus 9500 R-Series Switching Platform",
"product": {
"name": "NX-OS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR versions 6.4.x ant\u00e9rieures \u00e0 6.4.2",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco NX-OS versions ant\u00e9rieures \u00e0 14.0(2c) sur Nexus 9000 Series Fabric Switches Mode ACI",
"product": {
"name": "NX-OS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Small Business Sx200, Sx300, Sx500 et ESW2 Series Managed Switches versions ant\u00e9rieures \u00e0 1.4.10.6",
"product": {
"name": "Small Business",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco FXOS versions ant\u00e9rieures \u00e0 2.2.2.91 sur Firepower 4100 Series et Firepower 9300 Security Appliances",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco NX-OS versions ant\u00e9rieures \u00e0 6.2(11) sur MDS 9000 Series Multilayer Switches",
"product": {
"name": "NX-OS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco NX-OS versions ant\u00e9rieures \u00e0 7.1(5)N1(1b) sur Nexus 5500, 5600 et 6000 Series Switches",
"product": {
"name": "NX-OS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco NX-OS versions 7.0(3)I7(x) ant\u00e9rieures \u00e0 7.0(3)I7(2) sur Nexus 3000 Series Switches et Nexus 9000 Series Switches en Standalone NX-OS Mode",
"product": {
"name": "NX-OS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco FXOS versions 2.6.x ant\u00e9rieures \u00e0 2.6.1.131 sur Firepower 4100 Series et Firepower 9300 Security Appliances",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR versions 6.3.x ant\u00e9rieures \u00e0 6.3.3",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "EPN Manager versions ant\u00e9rieures \u00e0 3.0.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco NX-OS versions ant\u00e9rieures \u00e0 5.2(1)SM3(2.1) sur Nexus 1000V Switch for Microsoft Hyper-V",
"product": {
"name": "NX-OS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco NX-OS versions 7.3.x ant\u00e9rieures \u00e0 7.3(4)N1(1a) sur Nexus 5500, 5600 et 6000 Series Switches",
"product": {
"name": "NX-OS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Webex Network Recording Player et Webex Player versions ant\u00e9rieures \u00e0 Version 1.3.42 sur Cisco Webex Meetings Online",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR versions 6.1.x, 6.2.x et 6.5.x ant\u00e9rieures \u00e0 6.5.3",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Video Surveillance Manager versions ant\u00e9rieures \u00e0 7.12.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco NX-OS versions 8.0.x ant\u00e9rieures \u00e0 8.1(1) sur Nexus 7000 et 7700 Series Switches",
"product": {
"name": "NX-OS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco NX-OS versions ant\u00e9rieures \u00e0 6.0(2)A8(4) sur Nexus 3500 Platform Switches",
"product": {
"name": "NX-OS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco NX-OS versions 8.1(x) ant\u00e9rieures \u00e0 8.1(1) sur MDS 9000 Series Multilayer Switches",
"product": {
"name": "NX-OS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco FXOS versions 2.3.x ant\u00e9rieures \u00e0 2.3.1.130 sur Firepower 4100 Series et Firepower 9300 Security Appliances",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Webex Network Recording Player et Webex Player versions ant\u00e9rieures \u00e0 WBS39.2.205 sur Cisco Webex Business Suite sites",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco NX-OS versions ant\u00e9rieures \u00e0 7.0(3)I4(8) sur Nexus 3000 Series Switches et Nexus 9000 Series Switches en Standalone NX-OS Mode",
"product": {
"name": "NX-OS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco NX-OS versions ant\u00e9rieures \u00e0 5.2(1)SV3(4.1a) sur Nexus 1000V Switch for VMware vSphere",
"product": {
"name": "NX-OS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco NX-OS versions 7.2.x ant\u00e9rieures \u00e0 7.2(0)D1(1) sur Nexus 7000 et 7700 Series Switches",
"product": {
"name": "NX-OS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2019-1823",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1823"
},
{
"name": "CVE-2019-1717",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1717"
},
{
"name": "CVE-2019-1771",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1771"
},
{
"name": "CVE-2019-1821",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1821"
},
{
"name": "CVE-2019-1849",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1849"
},
{
"name": "CVE-2019-1806",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1806"
},
{
"name": "CVE-2019-1772",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1772"
},
{
"name": "CVE-2019-1846",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1846"
},
{
"name": "CVE-2019-1824",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1824"
},
{
"name": "CVE-2019-1825",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1825"
},
{
"name": "CVE-2019-1773",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1773"
},
{
"name": "CVE-2019-1822",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1822"
},
{
"name": "CVE-2019-1858",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1858"
}
],
"initial_release_date": "2019-05-16T00:00:00",
"last_revision_date": "2019-05-16T00:00:00",
"links": [],
"reference": "CERTFR-2019-AVI-228",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2019-05-16T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Cisco.\nElles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code\narbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0\nla confidentialit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
"vendor_advisories": [
{
"published_at": "2019-05-15",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190515-nxos-snmp-dos",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-snmp-dos"
},
{
"published_at": "2019-05-15",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190515-iosxr-evpn-dos",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-iosxr-evpn-dos"
},
{
"published_at": "2019-05-15",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190515-sb-snmpdos",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-sb-snmpdos"
},
{
"published_at": "2019-05-15",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190515-webex-player",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-webex-player"
},
{
"published_at": "2019-05-15",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190515-pi-rce",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-pi-rce"
},
{
"published_at": "2019-05-15",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190515-iosxr-mpls-dos",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-iosxr-mpls-dos"
},
{
"published_at": "2019-05-15",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190515-cvsm",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-cvsm"
},
{
"published_at": "2019-05-15",
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190515-pi-sqlinject",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-pi-sqlinject"
}
]
}
CERTFR-2019-AVI-181
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits Cisco. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une élévation de privilèges.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | Expressway Series | Cisco Expressway Series et Cisco TelePresence Video Communication Server versions antérieures à X12.5.1 | ||
| Cisco | N/A | Cisco Wireless LAN Controller versions 8.6.x, 8.7.x et 8.8.x antérieures à 8.8.120.0 | ||
| Cisco | IOS XR | Cisco IOS XR 64-bit versions antérieures à 6.5.3 et 7.0.1 | ||
| Cisco | N/A | Cisco Wireless LAN Controller versions antérieures à 8.3.150.0 | ||
| Cisco | N/A | Cisco Wireless LAN Controller versions 8.4.x et 8.5.x antérieures à 8.5.140.0 |
References
| Title | Publication Time | Tags | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Cisco Expressway Series et Cisco TelePresence Video Communication Server versions ant\u00e9rieures \u00e0 X12.5.1",
"product": {
"name": "Expressway Series",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Wireless LAN Controller versions 8.6.x, 8.7.x et 8.8.x ant\u00e9rieures \u00e0 8.8.120.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR 64-bit versions ant\u00e9rieures \u00e0 6.5.3 et 7.0.1",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Wireless LAN Controller versions ant\u00e9rieures \u00e0 8.3.150.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Wireless LAN Controller versions 8.4.x et 8.5.x ant\u00e9rieures \u00e0 8.5.140.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2019-1721",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1721"
},
{
"name": "CVE-2019-1710",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1710"
},
{
"name": "CVE-2019-1800",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1800"
},
{
"name": "CVE-2018-0248",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-0248"
},
{
"name": "CVE-2019-1796",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1796"
},
{
"name": "CVE-2019-1654",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1654"
},
{
"name": "CVE-2019-1797",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1797"
},
{
"name": "CVE-2019-1799",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1799"
}
],
"initial_release_date": "2019-04-18T00:00:00",
"last_revision_date": "2019-04-18T00:00:00",
"links": [],
"reference": "CERTFR-2019-AVI-181",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2019-04-18T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Cisco.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance\net une \u00e9l\u00e9vation de privil\u00e8ges.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190417-wlc-gui du 17 avril 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-wlc-gui"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190417-wlc-iapp du 17 avril 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-wlc-iapp"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190417-asr9k-exr du 17 avril 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-asr9k-exr"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190417-aironet-shell du 17 avril 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-aironet-shell"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190417-wlc-csrf du 17 avril 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-wlc-csrf"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190417-es-tvcs-dos du 17 avril 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-es-tvcs-dos"
}
]
}
CERTFR-2019-AVI-073
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits Cisco. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, un contournement de la politique de sécurité et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | N/A | Logiciel Cisco HyperFlex versions antérieures à 3.5(2a) | ||
| Cisco | N/A | Logiciel Cisco Prime Infrastructure versions 2.2 à 3.4.0 | ||
| Cisco | N/A | Logiciel Cisco PCA versions antérieures à 12.1 SP2 | ||
| Cisco | IOS XR | Logiciel Cisco IOS XR versions antérieures à 6.5.2 pour Cisco Network Convergence System 1000 Serie |
References
| Title | Publication Time | Tags | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Logiciel Cisco HyperFlex versions ant\u00e9rieures \u00e0 3.5(2a)",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Logiciel Cisco Prime Infrastructure versions 2.2 \u00e0 3.4.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Logiciel Cisco PCA versions ant\u00e9rieures \u00e0 12.1 SP2",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Logiciel Cisco IOS XR versions ant\u00e9rieures \u00e0 6.5.2 pour Cisco Network Convergence System 1000 Serie",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2019-1681",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1681"
},
{
"name": "CVE-2019-1659",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1659"
},
{
"name": "CVE-2019-1662",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1662"
},
{
"name": "CVE-2018-15380",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-15380"
},
{
"name": "CVE-2019-1664",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1664"
}
],
"initial_release_date": "2019-02-21T00:00:00",
"last_revision_date": "2019-02-21T00:00:00",
"links": [],
"reference": "CERTFR-2019-AVI-073",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2019-02-21T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Cisco.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire, un contournement de la politique de\ns\u00e9curit\u00e9 et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190220-hyperflex-injection du 20 f\u00e9vrier 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190220-hyperflex-injection"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190220-prime-validation du 20 f\u00e9vrier 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190220-prime-validation"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190220-pca-access du 20 f\u00e9vrier 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190220-pca-access"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190220-ncs du 20 f\u00e9vrier 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190220-ncs"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20190220-chn-root-access du 20 f\u00e9vrier 2019",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190220-chn-root-access"
}
]
}
CERTFR-2018-AVI-194
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits Cisco . Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | N/A | Cisco WebEx Meetings client versions antérieures à T32.1 | ||
| Cisco | IOS XR | Cisco IOS XR versions antérieures à 6.3.2 | ||
| Cisco | N/A | Cisco ASA versions 9.7.x antérieures à 9.7.1.24 | ||
| Cisco | N/A | Cisco Firepower ou FTD versions 6.2.3 sans les derniers correctifs de sécurité | ||
| Cisco | N/A | Cisco ASA versions 9.2.x antérieures à 9.2.4.27 | ||
| Cisco | N/A | Cisco VPC (StarOS) versions 5.5.x antérieures à N5.5.0 (21.3.v10) | ||
| Cisco | N/A | Cisco ASA versions 9.8.x antérieures à 9.8.2.28 | ||
| Cisco | N/A | Cisco ASA versions 9.9.x antérieures à 9.9.2.1 | ||
| Cisco | N/A | Cisco Firepower ou FTD versions 6.2.0.x antérieures à 6.2.0.5 | ||
| Cisco | N/A | Cisco VPC (StarOS) versions antérieures à N5.0.4 (21.0.v4) | ||
| Cisco | N/A | Cisco Firepower ou FTD versions 6.2.x antérieures à 6.2.2.1 | ||
| Cisco | N/A | Cisco Firepower ou FTD versions antérieures à 6.1.0.6 | ||
| Cisco | N/A | Cisco WebEx Meetings Server versions antérieures à 2.8 MR2 | ||
| Cisco | N/A | Cisco ASA versions antérieures à 9.1.7.20 | ||
| Cisco | N/A | Cisco WebEx Business Suite (WBS31) client versions antérieures à T31.23.2 | ||
| Cisco | N/A | Cisco Unified Computing System (UCS) Director versions 6.0 et 6.5 antérieures au patch 3 et configurées par défaut | ||
| Cisco | N/A | Cisco WebEx Business Suite (WBS32) client versions antérieures à T32.10 | ||
| Cisco | N/A | Cisco ASA versions 9.3.x ou 9.4.x antérieures à 9.4.4.14 | ||
| Cisco | N/A | Cisco ASA versions 9.5.x ou 9.6.x antérieures à 9.6.4.6 | ||
| Cisco | IOS XR | Cisco IOS XR versions 5.3.4 et 6.1.4 sans les derniers correctifs de sécurité | ||
| Cisco | N/A | Cisco VPC (StarOS) versions 5.1.x antérieures à N5.1.9 (21.1.v7) |
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Cisco WebEx Meetings client versions ant\u00e9rieures \u00e0 T32.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR versions ant\u00e9rieures \u00e0 6.3.2",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco ASA versions 9.7.x ant\u00e9rieures \u00e0 9.7.1.24",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Firepower ou FTD versions 6.2.3 sans les derniers correctifs de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco ASA versions 9.2.x ant\u00e9rieures \u00e0 9.2.4.27",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco VPC (StarOS) versions 5.5.x ant\u00e9rieures \u00e0 N5.5.0 (21.3.v10)",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco ASA versions 9.8.x ant\u00e9rieures \u00e0 9.8.2.28",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco ASA versions 9.9.x ant\u00e9rieures \u00e0 9.9.2.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Firepower ou FTD versions 6.2.0.x ant\u00e9rieures \u00e0 6.2.0.5",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco VPC (StarOS) versions ant\u00e9rieures \u00e0 N5.0.4 (21.0.v4)",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Firepower ou FTD versions 6.2.x ant\u00e9rieures \u00e0 6.2.2.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Firepower ou FTD versions ant\u00e9rieures \u00e0 6.1.0.6",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco WebEx Meetings Server versions ant\u00e9rieures \u00e0 2.8 MR2",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco ASA versions ant\u00e9rieures \u00e0 9.1.7.20",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco WebEx Business Suite (WBS31) client versions ant\u00e9rieures \u00e0 T31.23.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Unified Computing System (UCS) Director versions 6.0 et 6.5 ant\u00e9rieures au patch 3 et configur\u00e9es par d\u00e9faut",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco WebEx Business Suite (WBS32) client versions ant\u00e9rieures \u00e0 T32.10",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco ASA versions 9.3.x ou 9.4.x ant\u00e9rieures \u00e0 9.4.4.14",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco ASA versions 9.5.x ou 9.6.x ant\u00e9rieures \u00e0 9.6.4.6",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR versions 5.3.4 et 6.1.4 sans les derniers correctifs de s\u00e9curit\u00e9",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco VPC (StarOS) versions 5.1.x ant\u00e9rieures \u00e0 N5.1.9 (21.1.v7)",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2018-0230",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-0230"
},
{
"name": "CVE-2018-0238",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-0238"
},
{
"name": "CVE-2018-0241",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-0241"
},
{
"name": "CVE-2018-0228",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-0228"
},
{
"name": "CVE-2018-0239",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-0239"
},
{
"name": "CVE-2018-0233",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-0233"
},
{
"name": "CVE-2018-0112",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-0112"
},
{
"name": "CVE-2018-0240",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-0240"
},
{
"name": "CVE-2018-0231",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-0231"
},
{
"name": "CVE-2018-0227",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-0227"
},
{
"name": "CVE-2018-0229",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-0229"
}
],
"initial_release_date": "2018-04-19T00:00:00",
"last_revision_date": "2018-04-19T00:00:00",
"links": [],
"reference": "CERTFR-2018-AVI-194",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2018-04-19T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Cisco\n. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance\net un contournement de la politique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20180418-asaanyconnect du 18 avril 2018",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asaanyconnect"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20180418-staros du 18 avril 2018",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-staros"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20180418-wbs du 18 avril 2018",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-wbs"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20180418-asa3 du 18 avril 2018",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asa3"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20180418-fp2100 du 18 avril 2018",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-fp2100"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20180418-asa1 du 18 avril 2018",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asa1"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20180418-uscd du 18 avril 2018",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-uscd"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20180418-iosxr du 18 avril 2018",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-iosxr"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20180418-fpsnort du 18 avril 2018",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-fpsnort"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20180418-asa_inspect du 18 avril 2018",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asa_inspect"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20180418-asa2 du 18 avril 2018",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asa2"
}
]
}
CERTFR-2017-AVI-139
Vulnerability from certfr_avis
De multiples vulnérabilités ont été corrigées dans les produits Cisco. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | N/A | Cisco CVR100W Wireless-N VPN Router versions antérieures à 1.0.1.24 | ||
| Cisco | N/A | Cisco TelePresence Collaboration Endpoint (CE) versions antérieures à 8.3.2 | ||
| Cisco | IOS XR | Cisco IOS XR versions 6.1.x antérieures à 6.1.2 | ||
| Cisco | N/A | Cisco Aironet 1800, 2800, 3800 Access Points versions 8.3.x antérieures à 8.3.112.0 |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Cisco CVR100W Wireless-N VPN Router versions ant\u00e9rieures \u00e0 1.0.1.24",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco TelePresence Collaboration Endpoint (CE) versions ant\u00e9rieures \u00e0 8.3.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR versions 6.1.x ant\u00e9rieures \u00e0 6.1.2",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco Aironet 1800, 2800, 3800 Access Points versions 8.3.x ant\u00e9rieures \u00e0 8.3.112.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2017-6620",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-6620"
},
{
"name": "CVE-2017-3873",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-3873"
},
{
"name": "CVE-2017-3825",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-3825"
},
{
"name": "CVE-2017-3876",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-3876"
},
{
"name": "CVE-2017-3882",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-3882"
}
],
"initial_release_date": "2017-05-04T00:00:00",
"last_revision_date": "2017-05-04T00:00:00",
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20170503-ctp du 03 mai 2017",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170503-ctp"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20170503-cvr100w2 du 03 mai 2017",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170503-cvr100w2"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20170503-cme du 03 mai 2017",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170503-cme"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20170503-ios-xr du 03 mai 2017",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170503-ios-xr"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20170503-cvr100w1 du 03 mai 2017",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170503-cvr100w1"
}
],
"reference": "CERTFR-2017-AVI-139",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2017-05-04T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eles produits Cisco\u003c/span\u003e. Certaines d\u0027entre elles\npermettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire\n\u00e0 distance, un d\u00e9ni de service \u00e0 distance et un contournement de la\npolitique de s\u00e9curit\u00e9.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20170503-cvr100w2 du 03 mai 2017",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20170503-ios-xr du 03 mai 2017",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20170503-cvr100w1 du 03 mai 2017",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20170503-ctp du 03 mai 2017",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20170503-cme du 03 mai 2017",
"url": null
}
]
}
CERTFR-2016-AVI-235
Vulnerability from certfr_avis
De multiples vulnérabilités ont été corrigées dans les produits Cisco. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une exécution de code arbitraire et un déni de service à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | N/A | Cisco WebEx Meetings Server version 2.6 | ||
| Cisco | N/A | Cisco ASR 5000 Series versions antérieures à 20.1 | ||
| Cisco | IOS XR | Cisco IOS XR Software Release 6.0.1.BASE | ||
| Cisco | IOS XR | Cisco IOS XR pour Cisco Network Convergence System 6000 | ||
| Cisco | N/A | isco Meeting Server Software versions 1.7 à 1.9 | ||
| Cisco | N/A | Cisco ASR 5000 Series versions antérieures à 19.4 |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Cisco WebEx Meetings Server version 2.6",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco ASR 5000 Series versions ant\u00e9rieures \u00e0 20.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR Software Release 6.0.1.BASE",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR pour Cisco Network Convergence System 6000",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "isco Meeting Server Software versions 1.7 \u00e0 1.9",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco ASR 5000 Series versions ant\u00e9rieures \u00e0 19.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2016-1451",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-1451"
},
{
"name": "CVE-2016-1446",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-1446"
},
{
"name": "CVE-2016-1456",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-1456"
},
{
"name": "CVE-2016-1452",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-1452"
},
{
"name": "CVE-2016-1450",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-1450"
},
{
"name": "CVE-2016-1449",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-1449"
},
{
"name": "CVE-2016-1447",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-1447"
},
{
"name": "CVE-2016-1426",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-1426"
}
],
"initial_release_date": "2016-07-15T00:00:00",
"last_revision_date": "2016-07-15T00:00:00",
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160714-ios-xr du 14 juillet 2016",
"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160714-ios-xr"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160714-wms du 14 juillet 2016",
"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160714-wms"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160714-ms du 14 juillet 2016",
"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160714-ms"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160714-wms3 du 14 juillet 2016",
"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160714-wms3"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160714-wms4 du 14 juillet 2016",
"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160714-wms4"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160714-wms1 du 14 juillet 2016",
"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160714-wms1"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160713-asr du 13 juillet 2016",
"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160713-ncs6k"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160713-ncs6k du 13 juillet 2016",
"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160713-ncs6k"
}
],
"reference": "CERTFR-2016-AVI-235",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2016-07-15T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Ex\u00e9cution de code arbitraire"
},
{
"description": "Injection de code indirecte \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans les produits \u003cspan\nclass=\"textit\"\u003eCisco\u003c/span\u003e. Certaines d\u0027entre elles permettent \u00e0 un\nattaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une\nex\u00e9cution de code arbitraire et un d\u00e9ni de service \u00e0 distance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160714-wms3 du 14 juillet 2016",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160714-wms1 du 14 juillet 2016",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160714-wms du 14 juillet 2016",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160713-asr du 13 juillet 2016",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160713-ncs6k du 13 juillet 2016",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160714-ms du 14 juillet 2016",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160714-wms4 du 14 juillet 2016",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160714-ios-xr du 14 juillet 2016",
"url": null
}
]
}
CERTFR-2016-AVI-129
Vulnerability from certfr_avis
De multiples vulnérabilités ont été corrigées dans les produits Cisco. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, un contournement de la politique de sécurité et une atteinte à la confidentialité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | Unity Connection | Cisco Unity Connection versions 11.0 et antérieures | ||
| Cisco | IOS XR | Cisco IOS XR versions 4.2.3, 4.3.0, 4.3.4, et 5.3.1 s'exécutant sur les routeurs à services d'agrégation Cisco séries ASR 9000 | ||
| Cisco | N/A | Cisco IP Interoperability and Collaboration System version 4.10(1) | ||
| Cisco | IOS | Cisco IOS versions antérieures à 15.2(2)E1 | ||
| Cisco | N/A | Cisco UCS Central Software versions antérieures à 1.3(1c) |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Cisco Unity Connection versions 11.0 et ant\u00e9rieures",
"product": {
"name": "Unity Connection",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR versions 4.2.3, 4.3.0, 4.3.4, et 5.3.1 s\u0027ex\u00e9cutant sur les routeurs \u00e0 services d\u0027agr\u00e9gation Cisco s\u00e9ries ASR 9000",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IP Interoperability and Collaboration System version 4.10(1)",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS versions ant\u00e9rieures \u00e0 15.2(2)E1",
"product": {
"name": "IOS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco UCS Central Software versions ant\u00e9rieures \u00e0 1.3(1c)",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2016-1377",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-1377"
},
{
"name": "CVE-2016-1352",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-1352"
},
{
"name": "CVE-2016-1376",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-1376"
},
{
"name": "CVE-2016-1378",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-1378"
},
{
"name": "CVE-2016-1375",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-1375"
}
],
"initial_release_date": "2016-04-14T00:00:00",
"last_revision_date": "2016-04-14T00:00:00",
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160407-cic du 7 avril 2016",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160407-cic"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160412-asr du 12 avril 2016",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160412-asr"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160412-unity du 12 avril 2016",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160412-unity"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160413-ucs du 13 avril 2016",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160413-ucs"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160413-nms du 13 avril 2016",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160413-nms"
}
],
"reference": "CERTFR-2016-AVI-129",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2016-04-14T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eles produits Cisco\u003c/span\u003e. Certaines d\u0027entre elles\npermettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance, un\ncontournement de la politique de s\u00e9curit\u00e9 et une atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160413-ucs du 13 avril 2016",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160412-unity du 12 avril 2016",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160407-cic du 7 avril 2016",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160412-asr du 12 avril 2016",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160413-nms du 13 avril 2016",
"url": null
}
]
}
CERTFR-2016-AVI-107
Vulnerability from certfr_avis
De multiples vulnérabilités ont été corrigées dans les produits Cisco. Elles permettent à un attaquant de provoquer un déni de service à distance et une atteinte à l'intégrité des données.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | IOS XE | Produits Cisco exécutant Cisco IOS ou IOS XE, voir sur le site du constructeur pour vérifier si votre système est vulnérable (lien fourni dans la rubrique Documentation) | ||
| Cisco | IOS | Produits Cisco exécutant Cisco IOS avec WAAS Express configuré sur une ou plusieurs interfaces sans fil, voir sur le site du constructeur pour vérifier si votre système est vulnérable (lien fourni dans la rubrique Documentation) | ||
| Cisco | N/A | Produits Cisco exécutant Cisco IOS, IOS XE ou Cisco Unified Communications Manager Software, configurés pour traiter les messages SIP , voir sur le site du constructeur pour vérifier si votre système est vulnérable (lien fourni dans la rubrique Documentation) | ||
| Cisco | IOS XR | Routeurs Cisco Network Convergence System séries 6000 exécutant Cisco IOS XR | ||
| Cisco | NX-OS | Commutateurs Cisco Nexus séries 7000 et 7700 avec un module Gigabit Ethernet série M1 exécutant Cisco NX-OS avec LISP configuré | ||
| Cisco | IOS | Commutateurs Cisco Catalyst séries 6500 et 6800 exécutant Cisco IOS avec LISP configuré |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Produits Cisco ex\u00e9cutant Cisco IOS ou IOS XE, voir sur le site du constructeur pour v\u00e9rifier si votre syst\u00e8me est vuln\u00e9rable (lien fourni dans la rubrique Documentation)",
"product": {
"name": "IOS XE",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Produits Cisco ex\u00e9cutant Cisco IOS avec WAAS Express configur\u00e9 sur une ou plusieurs interfaces sans fil, voir sur le site du constructeur pour v\u00e9rifier si votre syst\u00e8me est vuln\u00e9rable (lien fourni dans la rubrique Documentation)",
"product": {
"name": "IOS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Produits Cisco ex\u00e9cutant Cisco IOS, IOS XE ou Cisco Unified Communications Manager Software, configur\u00e9s pour traiter les messages SIP , voir sur le site du constructeur pour v\u00e9rifier si votre syst\u00e8me est vuln\u00e9rable (lien fourni dans la rubrique Documentation)",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Routeurs Cisco Network Convergence System s\u00e9ries 6000 ex\u00e9cutant Cisco IOS XR",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Commutateurs Cisco Nexus s\u00e9ries 7000 et 7700 avec un module Gigabit Ethernet s\u00e9rie M1 ex\u00e9cutant Cisco NX-OS avec LISP configur\u00e9",
"product": {
"name": "NX-OS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Commutateurs Cisco Catalyst s\u00e9ries 6500 et 6800 ex\u00e9cutant Cisco IOS avec LISP configur\u00e9",
"product": {
"name": "IOS",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2016-1344",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-1344"
},
{
"name": "CVE-2016-1366",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-1366"
},
{
"name": "CVE-2016-1350",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-1350"
},
{
"name": "CVE-2016-1349",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-1349"
},
{
"name": "CVE-2016-1348",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-1348"
},
{
"name": "CVE-2016-1347",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-1347"
},
{
"name": "CVE-2016-1351",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-1351"
}
],
"initial_release_date": "2016-03-24T00:00:00",
"last_revision_date": "2016-03-24T00:00:00",
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160323-sip du 23 mars 2016",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160323-sip"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160323-smi du 23 mars 2016",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160323-smi"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160323-l4f du 23 mars 2016",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160323-l4f"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160323-dhcpv6 du 23 mars 2016",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160323-dhcpv6"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160323-lisp du 23 mars 2016",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160323-lisp"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160323-ncs du 23 mars 2016",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160323-ncs"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160323-ios-ikev2 du 23 mars 2016",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160323-ios-ikev2"
}
],
"reference": "CERTFR-2016-AVI-107",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2016-03-24T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eles produits Cisco\u003c/span\u003e. Elles permettent \u00e0 un\nattaquant de provoquer un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0\nl\u0027int\u00e9grit\u00e9 des donn\u00e9es.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Cisco",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160323-smi du 23 mars 2016",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160323-dhcpv6 du 23 mars 2016",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160323-ncs du 23 mars 2016",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160323-ios-ikev2 du 23 mars 2016",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160323-lisp du 23 mars 2016",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160323-l4f du 23 mars 2016",
"url": null
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160323-sip du 23 mars 2016",
"url": null
}
]
}
CERTFR-2016-ALE-007
Vulnerability from certfr_alerte
Une vulnérabilité a été découverte dans Cisco IOS, Cisco IOS XE et Cisco IOS XR. Elle permet à un attaquant de provoquer une atteinte à la confidentialité des données.
Contournement provisoire
Suite à la fuite de codes d'attaque attribués au groupe Equation le mois
dernier, Cisco a enquêté pour déterminer si d'autres de ses produits
sont vulnérables à des attaques similaires.
Il s'avère que plusieurs produits peuvent être exploités par une méthode
semblable à BENIGNCERTAIN, qui permet à un attaquant d'accéder à des
portions de mémoire, dans l'espoir de découvrir des secrets (clés
privées, mots de passe...)
Ici, une vulnérabilité dans le code de traitement des paquets IKEv1 de
Cisco IOS, IOS XE et IOS XR permet à un attaquant non authentifié de
récupérer des portions de mémoire, et ce à distance.
Cisco indique qu'il n'existe pour l'instant pas de mitigations et que
cette vulnérabilité est activement exploitée chez certains de ses
clients.
Cisco fourni des règles de détection, cependant celles-ci sont soumises
à abonnement.
Le CERT-FR recommande l'application des correctifs de sécurité dans les
cas où ceux-ci sont disponibles. Sinon, les tunnels IPsec établis sur
des systèmes affectés doivent être considérés comme non sécurisés.
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Cisco | N/A | Cisco IOS, voir sur le site du constructeur pour vérifier si votre système est vulnérable (cf. section Documentation) | ||
| Cisco | IOS XR | Cisco IOS XR versions 5.0.x | ||
| Cisco | IOS XR | Cisco IOS XR versions 5.2.x | ||
| Cisco | IOS XR | Cisco IOS XR versions 5.1.x | ||
| Cisco | IOS XR | Cisco IOS XR versions 4.3.x | ||
| Cisco | IOS XE | Cisco IOS XE toutes versions |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Cisco IOS, voir sur le site du constructeur pour v\u00e9rifier si votre syst\u00e8me est vuln\u00e9rable (cf. section Documentation)",
"product": {
"name": "N/A",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR versions 5.0.x",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR versions 5.2.x",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR versions 5.1.x",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XR versions 4.3.x",
"product": {
"name": "IOS XR",
"vendor": {
"name": "Cisco",
"scada": false
}
}
},
{
"description": "Cisco IOS XE toutes versions",
"product": {
"name": "IOS XE",
"vendor": {
"name": "Cisco",
"scada": false
}
}
}
],
"affected_systems_content": null,
"closed_at": "2017-09-29",
"content": "## Contournement provisoire\n\nSuite \u00e0 la fuite de codes d\u0027attaque attribu\u00e9s au groupe Equation le mois\ndernier, Cisco a enqu\u00eat\u00e9 pour d\u00e9terminer si d\u0027autres de ses produits\nsont vuln\u00e9rables \u00e0 des attaques similaires. \nIl s\u0027av\u00e8re que plusieurs produits peuvent \u00eatre exploit\u00e9s par une m\u00e9thode\nsemblable \u00e0 BENIGNCERTAIN, qui permet \u00e0 un attaquant d\u0027acc\u00e9der \u00e0 des\nportions de m\u00e9moire, dans l\u0027espoir de d\u00e9couvrir des secrets (cl\u00e9s\npriv\u00e9es, mots de passe...) \nIci, une vuln\u00e9rabilit\u00e9 dans le code de traitement des paquets IKEv1 de\nCisco IOS, IOS XE et IOS XR permet \u00e0 un attaquant non authentifi\u00e9 de\nr\u00e9cup\u00e9rer des portions de m\u00e9moire, et ce \u00e0 distance. \nCisco indique qu\u0027il n\u0027existe pour l\u0027instant pas de mitigations et que\ncette vuln\u00e9rabilit\u00e9 est activement exploit\u00e9e chez certains de ses\nclients. \nCisco fourni des r\u00e8gles de d\u00e9tection, cependant celles-ci sont soumises\n\u00e0 abonnement. \nLe CERT-FR recommande l\u0027application des correctifs de s\u00e9curit\u00e9 dans les\ncas o\u00f9 ceux-ci sont disponibles. Sinon, les tunnels IPsec \u00e9tablis sur\ndes syst\u00e8mes affect\u00e9s doivent \u00eatre consid\u00e9r\u00e9s comme non s\u00e9curis\u00e9s.\n",
"cves": [
{
"name": "CVE-2016-6415",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-6415"
}
],
"initial_release_date": "2016-09-19T00:00:00",
"last_revision_date": "2016-09-19T00:00:00",
"links": [],
"reference": "CERTFR-2016-ALE-007",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2016-09-19T00:00:00.000000"
}
],
"risks": [
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans \u003cspan class=\"textit\"\u003eCisco\nIOS\u003c/span\u003e, \u003cspan class=\"textit\"\u003eCisco IOS XE\u003c/span\u003e et \u003cspan\nclass=\"textit\"\u003eCisco IOS XR\u003c/span\u003e. Elle permet \u00e0 un attaquant de\nprovoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
"title": "Vuln\u00e9rabilit\u00e9 dans Cisco IOS, IOS XE et IOS XR",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160916-ikev1 du 16 septembre 2016",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160916-ikev1"
}
]
}