cnvd - cnvd-2015-03783

cnvd-2015-03783

Vulnerability from cnvd

Title: Cisco Prime网络控制系统特权提升漏洞

Description:

Cisco Prime Infrastructure是一个一体化软件包可提供完整的基础设施(有线和无线)以及移动生命周期管理(配置、监控、故障排除、修正和报告)。

Cisco Prime Network Control System存在安全漏洞，允许通过验证的用户提交特殊的请求，提升权限，执行受限命令。

Severity: 中

Patch Name: Cisco Prime网络控制系统特权提升漏的补丁

Patch Description:

Cisco Prime Infrastructure是一个一体化软件包可提供完整的基础设施(有线和无线)以及移动生命周期管理(配置、监控、故障排除、修正和报告)。

Cisco Prime Network Control System存在安全漏洞，允许通过验证的用户提交特殊的请求，提升权限，执行受限命令。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

用户可参考如下厂商提供的安全公告获取补丁以修复该漏洞： http://tools.cisco.com/security/center/viewAlert.x?alertId=39192

Reference: http://tools.cisco.com/security/center/viewAlert.x?alertId=39192

Impacted products

Name
['Cisco Prime Network Control System 2.1(0.0.85)', 'Cisco Prime Network Control System 2.2(0.0.58)', 'Cisco Prime Network Control System 2.2(0.0.69)']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "75096"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2015-0768"
    }
  },
  "description": "Cisco Prime Infrastructure\u662f\u4e00\u4e2a\u4e00\u4f53\u5316\u8f6f\u4ef6\u5305\u53ef\u63d0\u4f9b\u5b8c\u6574\u7684\u57fa\u7840\u8bbe\u65bd(\u6709\u7ebf\u548c\u65e0\u7ebf)\u4ee5\u53ca\u79fb\u52a8\u751f\u547d\u5468\u671f\u7ba1\u7406(\u914d\u7f6e\u3001\u76d1\u63a7\u3001\u6545\u969c\u6392\u9664\u3001\u4fee\u6b63\u548c\u62a5\u544a)\u3002\r\n\r\nCisco Prime Network Control System\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u5141\u8bb8\u901a\u8fc7\u9a8c\u8bc1\u7684\u7528\u6237\u63d0\u4ea4\u7279\u6b8a\u7684\u8bf7\u6c42\uff0c\u63d0\u5347\u6743\u9650\uff0c\u6267\u884c\u53d7\u9650\u547d\u4ee4\u3002",
  "discovererName": "Cisco",
  "formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u5382\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u516c\u544a\u83b7\u53d6\u8865\u4e01\u4ee5\u4fee\u590d\u8be5\u6f0f\u6d1e\uff1a\r\nhttp://tools.cisco.com/security/center/viewAlert.x?alertId=39192",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2015-03783",
  "openTime": "2015-06-15",
  "patchDescription": "Cisco Prime Infrastructure\u662f\u4e00\u4e2a\u4e00\u4f53\u5316\u8f6f\u4ef6\u5305\u53ef\u63d0\u4f9b\u5b8c\u6574\u7684\u57fa\u7840\u8bbe\u65bd(\u6709\u7ebf\u548c\u65e0\u7ebf)\u4ee5\u53ca\u79fb\u52a8\u751f\u547d\u5468\u671f\u7ba1\u7406(\u914d\u7f6e\u3001\u76d1\u63a7\u3001\u6545\u969c\u6392\u9664\u3001\u4fee\u6b63\u548c\u62a5\u544a)\u3002 \r\n\r\nCisco Prime Network Control System\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u5141\u8bb8\u901a\u8fc7\u9a8c\u8bc1\u7684\u7528\u6237\u63d0\u4ea4\u7279\u6b8a\u7684\u8bf7\u6c42\uff0c\u63d0\u5347\u6743\u9650\uff0c\u6267\u884c\u53d7\u9650\u547d\u4ee4\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Cisco Prime\u7f51\u7edc\u63a7\u5236\u7cfb\u7edf\u7279\u6743\u63d0\u5347\u6f0f\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Cisco Prime Network Control System 2.1(0.0.85)",
      "Cisco Prime Network Control System  2.2(0.0.58)",
      "Cisco Prime Network Control System  2.2(0.0.69)"
    ]
  },
  "referenceLink": "http://tools.cisco.com/security/center/viewAlert.x?alertId=39192",
  "serverity": "\u4e2d",
  "submitTime": "2015-06-11",
  "title": "Cisco Prime\u7f51\u7edc\u63a7\u5236\u7cfb\u7edf\u7279\u6743\u63d0\u5347\u6f0f\u6d1e"
}

CVE-2015-0768 (GCVE-0-2015-0768)

Vulnerability from cvelistv5

Published

2015-06-12 14:00

Modified

2024-08-06 04:17

Severity ?

CWE

Summary

The Device Work Center (DWC) component in Cisco Prime Network Control System (NCS) 2.1(0.0.85), 2.2(0.0.58), and 2.2(0.0.69) does not properly implement AAA roles, which allows remote authenticated users to bypass intended access restrictions and execute commands via a login session, aka Bug ID CSCur27371.

References

▼	URL	Tags
	http://tools.cisco.com/security/center/viewAlert.x?alertId=39192	vendor-advisory, x_refsource_CISCO
	http://www.securitytracker.com/id/1032541	vdb-entry, x_refsource_SECTRACK

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T04:17:32.822Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20150609 Cisco Prime Network Control System Unauthorized Configuration Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "http://tools.cisco.com/security/center/viewAlert.x?alertId=39192"
          },
          {
            "name": "1032541",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1032541"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-06-09T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Device Work Center (DWC) component in Cisco Prime Network Control System (NCS) 2.1(0.0.85), 2.2(0.0.58), and 2.2(0.0.69) does not properly implement AAA roles, which allows remote authenticated users to bypass intended access restrictions and execute commands via a login session, aka Bug ID CSCur27371."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-12-29T18:57:01",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "20150609 Cisco Prime Network Control System Unauthorized Configuration Vulnerability",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "http://tools.cisco.com/security/center/viewAlert.x?alertId=39192"
        },
        {
          "name": "1032541",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1032541"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@cisco.com",
          "ID": "CVE-2015-0768",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Device Work Center (DWC) component in Cisco Prime Network Control System (NCS) 2.1(0.0.85), 2.2(0.0.58), and 2.2(0.0.69) does not properly implement AAA roles, which allows remote authenticated users to bypass intended access restrictions and execute commands via a login session, aka Bug ID CSCur27371."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20150609 Cisco Prime Network Control System Unauthorized Configuration Vulnerability",
              "refsource": "CISCO",
              "url": "http://tools.cisco.com/security/center/viewAlert.x?alertId=39192"
            },
            {
              "name": "1032541",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1032541"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2015-0768",
    "datePublished": "2015-06-12T14:00:00",
    "dateReserved": "2015-01-07T00:00:00",
    "dateUpdated": "2024-08-06T04:17:32.822Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted