Vulnerability-Lookup

CERTFR-2016-ALE-007

Vulnerability from certfr_alerte - Published: - Updated:

Une vulnérabilité a été découverte dans Cisco IOS, Cisco IOS XE et Cisco IOS XR. Elle permet à un attaquant de provoquer une atteinte à la confidentialité des données.

Contournement provisoire

Suite à la fuite de codes d'attaque attribués au groupe Equation le mois dernier, Cisco a enquêté pour déterminer si d'autres de ses produits sont vulnérables à des attaques similaires.
Il s'avère que plusieurs produits peuvent être exploités par une méthode semblable à BENIGNCERTAIN, qui permet à un attaquant d'accéder à des portions de mémoire, dans l'espoir de découvrir des secrets (clés privées, mots de passe...)
Ici, une vulnérabilité dans le code de traitement des paquets IKEv1 de Cisco IOS, IOS XE et IOS XR permet à un attaquant non authentifié de récupérer des portions de mémoire, et ce à distance.
Cisco indique qu'il n'existe pour l'instant pas de mitigations et que cette vulnérabilité est activement exploitée chez certains de ses clients.
Cisco fourni des règles de détection, cependant celles-ci sont soumises à abonnement.
Le CERT-FR recommande l'application des correctifs de sécurité dans les cas où ceux-ci sont disponibles. Sinon, les tunnels IPsec établis sur des systèmes affectés doivent être considérés comme non sécurisés.

None

Impacted products

Vendor	Product	Description
Cisco	N/A	Cisco IOS, voir sur le site du constructeur pour vérifier si votre système est vulnérable (cf. section Documentation)
Cisco	IOS XR	Cisco IOS XR versions 5.0.x
Cisco	IOS XR	Cisco IOS XR versions 5.2.x
Cisco	IOS XR	Cisco IOS XR versions 5.1.x
Cisco	IOS XR	Cisco IOS XR versions 4.3.x
Cisco	IOS XE	Cisco IOS XE toutes versions

References

Title

Publication Time

Tags

Bulletin de sécurité Cisco cisco-sa-20160916-ikev1 du 16 septembre 2016

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Cisco IOS, voir sur le site du constructeur pour v\u00e9rifier si votre syst\u00e8me est vuln\u00e9rable (cf. section Documentation)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco IOS XR versions 5.0.x",
      "product": {
        "name": "IOS XR",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco IOS XR versions 5.2.x",
      "product": {
        "name": "IOS XR",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco IOS XR versions 5.1.x",
      "product": {
        "name": "IOS XR",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco IOS XR versions 4.3.x",
      "product": {
        "name": "IOS XR",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco IOS XE toutes versions",
      "product": {
        "name": "IOS XE",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "closed_at": "2017-09-29",
  "content": "## Contournement provisoire\n\nSuite \u00e0 la fuite de codes d\u0027attaque attribu\u00e9s au groupe Equation le mois\ndernier, Cisco a enqu\u00eat\u00e9 pour d\u00e9terminer si d\u0027autres de ses produits\nsont vuln\u00e9rables \u00e0 des attaques similaires.  \nIl s\u0027av\u00e8re que plusieurs produits peuvent \u00eatre exploit\u00e9s par une m\u00e9thode\nsemblable \u00e0 BENIGNCERTAIN, qui permet \u00e0 un attaquant d\u0027acc\u00e9der \u00e0 des\nportions de m\u00e9moire, dans l\u0027espoir de d\u00e9couvrir des secrets (cl\u00e9s\npriv\u00e9es, mots de passe...)  \nIci, une vuln\u00e9rabilit\u00e9 dans le code de traitement des paquets IKEv1 de\nCisco IOS, IOS XE et IOS XR permet \u00e0 un attaquant non authentifi\u00e9 de\nr\u00e9cup\u00e9rer des portions de m\u00e9moire, et ce \u00e0 distance.  \nCisco indique qu\u0027il n\u0027existe pour l\u0027instant pas de mitigations et que\ncette vuln\u00e9rabilit\u00e9 est activement exploit\u00e9e chez certains de ses\nclients.  \nCisco fourni des r\u00e8gles de d\u00e9tection, cependant celles-ci sont soumises\n\u00e0 abonnement.  \nLe CERT-FR recommande l\u0027application des correctifs de s\u00e9curit\u00e9 dans les\ncas o\u00f9 ceux-ci sont disponibles. Sinon, les tunnels IPsec \u00e9tablis sur\ndes syst\u00e8mes affect\u00e9s doivent \u00eatre consid\u00e9r\u00e9s comme non s\u00e9curis\u00e9s.\n",
  "cves": [
    {
      "name": "CVE-2016-6415",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-6415"
    }
  ],
  "links": [],
  "reference": "CERTFR-2016-ALE-007",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2016-09-19T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans \u003cspan class=\"textit\"\u003eCisco\nIOS\u003c/span\u003e, \u003cspan class=\"textit\"\u003eCisco IOS XE\u003c/span\u003e et \u003cspan\nclass=\"textit\"\u003eCisco IOS XR\u003c/span\u003e. Elle permet \u00e0 un attaquant de\nprovoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Cisco IOS, IOS XE et IOS XR",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160916-ikev1 du 16 septembre 2016",
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160916-ikev1"
    }
  ]
}

CVE-2016-6415 (GCVE-0-2016-6415)

Vulnerability from cvelistv5 – Published: 2016-09-19 01:00 – Updated: 2026-01-12 21:16

Summary

The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.x and 5.0.x through 5.2.x, and PIX before 7.0 allows remote attackers to obtain sensitive information from device memory via a Security Association (SA) negotiation request, aka Bug IDs CSCvb29204 and CSCvb36055 or BENIGNCERTAIN.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: active Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-11-08 17:38 UTC

CWE

n/a
CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

cisco

References

4 references

URL	Tags
http://www.securitytracker.com/id/1036841	vdb-entryx_refsource_SECTRACK
http://tools.cisco.com/security/center/content/Ci…	vendor-advisoryx_refsource_CISCO
http://www.securityfocus.com/bid/93003	vdb-entryx_refsource_BID
https://www.cisa.gov/known-exploited-vulnerabilit…	government-resource

Date Public

2016-09-16 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T01:29:20.096Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "1036841",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1036841"
          },
          {
            "name": "20160916 IKEv1 Information Disclosure Vulnerability in Multiple Cisco Products",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160916-ikev1"
          },
          {
            "name": "93003",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/93003"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2016-6415",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-08T17:38:29.489776Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2023-05-19",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-6415"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-200",
                "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-12T21:16:07.939Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-6415"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-09-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.x and 5.0.x through 5.2.x, and PIX before 7.0 allows remote attackers to obtain sensitive information from device memory via a Security Association (SA) negotiation request, aka Bug IDs CSCvb29204 and CSCvb36055 or BENIGNCERTAIN."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-07-29T09:57:01.000Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "1036841",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1036841"
        },
        {
          "name": "20160916 IKEv1 Information Disclosure Vulnerability in Multiple Cisco Products",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160916-ikev1"
        },
        {
          "name": "93003",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/93003"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@cisco.com",
          "ID": "CVE-2016-6415",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.x and 5.0.x through 5.2.x, and PIX before 7.0 allows remote attackers to obtain sensitive information from device memory via a Security Association (SA) negotiation request, aka Bug IDs CSCvb29204 and CSCvb36055 or BENIGNCERTAIN."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "1036841",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1036841"
            },
            {
              "name": "20160916 IKEv1 Information Disclosure Vulnerability in Multiple Cisco Products",
              "refsource": "CISCO",
              "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160916-ikev1"
            },
            {
              "name": "93003",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/93003"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2016-6415",
    "datePublished": "2016-09-19T01:00:00.000Z",
    "dateReserved": "2016-07-26T00:00:00.000Z",
    "dateUpdated": "2026-01-12T21:16:07.939Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted