cnvd - cnvd-2017-03298

cnvd-2017-03298

Vulnerability from cnvd

Title: Cisco StarOS权限提升漏洞

Description:

Cisco StarOS是美国思科（Cisco）公司的一套运行于5000等系列路由器设备中的操作系统。

Cisco StarOS存在权限提升漏洞。攻击者可利用此漏洞获取受影响设备上已提升的root权限。

Severity: 高

Patch Name: Cisco StarOS权限提升漏洞的补丁

Patch Description:

Cisco StarOS是美国思科（Cisco）公司的一套运行于5000等系列路由器设备中的操作系统。

Cisco StarOS存在权限提升漏洞。攻击者可利用此漏洞获取受影响设备上已提升的root权限。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新： https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-asr

Reference: http://www.securityfocus.com/bid/96913

Impacted products

Name
['Cisco ASR 5000 Series 0', 'Cisco StarOS 20.0', 'Cisco StarOS 19.0', 'Cisco StarOS 18.0', 'Cisco StarOS 17.0', 'Cisco ASR 5700 Series 0', 'Cisco ASR 5500 Series 0', 'Cisco Virtualized Packet Core (vPC) Software N4.7 (20.2)', 'Cisco Virtualized Packet Core (vPC) Software N4.6 (20.1)', 'Cisco Virtualized Packet Core (vPC) Software N4.5 (20.0)', 'Cisco Virtualized Packet Core (vPC) Software N4.2 (19.3)', 'Cisco Virtualized Packet Core (vPC) Software N4.0 (19.2)']

Name

['Cisco ASR 5000 Series 0', 'Cisco StarOS 20.0', 'Cisco StarOS 19.0', 'Cisco StarOS 18.0', 'Cisco StarOS 17.0', 'Cisco ASR 5700 Series 0', 'Cisco ASR 5500 Series 0', 'Cisco Virtualized Packet Core (vPC) Software N4.7 (20.2)', 'Cisco Virtualized Packet Core (vPC) Software N4.6 (20.1)', 'Cisco Virtualized Packet Core (vPC) Software N4.5 (20.0)', 'Cisco Virtualized Packet Core (vPC) Software N4.2 (19.3)', 'Cisco Virtualized Packet Core (vPC) Software N4.0 (19.2)']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "96913"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-3819",
      "cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3819"
    }
  },
  "description": "Cisco StarOS\u662f\u7f8e\u56fd\u601d\u79d1\uff08Cisco\uff09\u516c\u53f8\u7684\u4e00\u5957\u8fd0\u884c\u4e8e5000\u7b49\u7cfb\u5217\u8def\u7531\u5668\u8bbe\u5907\u4e2d\u7684\u64cd\u4f5c\u7cfb\u7edf\u3002\r\n\r\nCisco StarOS\u5b58\u5728\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u6b64\u6f0f\u6d1e\u83b7\u53d6\u53d7\u5f71\u54cd\u8bbe\u5907\u4e0a\u5df2\u63d0\u5347\u7684root\u6743\u9650\u3002",
  "discovererName": "Cisco",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-asr",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-03298",
  "openTime": "2017-03-24",
  "patchDescription": "Cisco StarOS\u662f\u7f8e\u56fd\u601d\u79d1\uff08Cisco\uff09\u516c\u53f8\u7684\u4e00\u5957\u8fd0\u884c\u4e8e5000\u7b49\u7cfb\u5217\u8def\u7531\u5668\u8bbe\u5907\u4e2d\u7684\u64cd\u4f5c\u7cfb\u7edf\u3002\r\n\r\nCisco StarOS\u5b58\u5728\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u6b64\u6f0f\u6d1e\u83b7\u53d6\u53d7\u5f71\u54cd\u8bbe\u5907\u4e0a\u5df2\u63d0\u5347\u7684root\u6743\u9650\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Cisco StarOS\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Cisco ASR 5000 Series 0",
      "Cisco StarOS 20.0",
      "Cisco StarOS  19.0",
      "Cisco StarOS  18.0",
      "Cisco StarOS  17.0",
      "Cisco ASR 5700 Series 0",
      "Cisco ASR 5500 Series 0",
      "Cisco Virtualized Packet Core (vPC) Software N4.7 (20.2)",
      "Cisco Virtualized Packet Core (vPC) Software  N4.6 (20.1)",
      "Cisco Virtualized Packet Core (vPC) Software  N4.5 (20.0)",
      "Cisco Virtualized Packet Core (vPC) Software  N4.2 (19.3)",
      "Cisco Virtualized Packet Core (vPC) Software  N4.0 (19.2)"
    ]
  },
  "referenceLink": "http://www.securityfocus.com/bid/96913",
  "serverity": "\u9ad8",
  "submitTime": "2017-03-16",
  "title": "Cisco StarOS\u6743\u9650\u63d0\u5347\u6f0f\u6d1e"
}

CVE-2017-3819 (GCVE-0-2017-3819)

Vulnerability from cvelistv5

Published

2017-03-15 20:00

Modified

2024-08-05 14:39

Severity ?

CWE

CWE-264 - Privilege Escalation Vulnerability

Summary

A privilege escalation vulnerability in the Secure Shell (SSH) subsystem in the StarOS operating system for Cisco ASR 5000 Series, ASR 5500 Series, ASR 5700 Series devices, and Cisco Virtualized Packet Core could allow an authenticated, remote attacker to gain unrestricted, root shell access. The vulnerability is due to missing input validation of parameters passed during SSH or SFTP login. An attacker could exploit this vulnerability by providing crafted user input to the SSH or SFTP command-line interface (CLI) during SSH or SFTP login. An exploit could allow an authenticated attacker to gain root privileges access on the router. Note: Only traffic directed to the affected system can be used to exploit this vulnerability. This vulnerability can be triggered via both IPv4 and IPv6 traffic. An established TCP connection toward port 22, the SSH default port, is needed to perform the attack. The attacker must have valid credentials to login to the system via SSH or SFTP. The following products have been confirmed to be vulnerable: Cisco ASR 5000/5500/5700 Series devices running StarOS after 17.7.0 and prior to 18.7.4, 19.5, and 20.2.3 with SSH configured are vulnerable. Cisco Virtualized Packet Core - Single Instance (VPC-SI) and Distributed Instance (VPC-DI) devices running StarOS prior to N4.2.7 (19.3.v7) and N4.7 (20.2.v0) with SSH configured are vulnerable. Cisco Bug IDs: CSCva65853.

References

▼	URL	Tags
	http://www.securityfocus.com/bid/96913	vdb-entry, x_refsource_BID
	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-asr	x_refsource_CONFIRM
	http://www.securitytracker.com/id/1038050	vdb-entry, x_refsource_SECTRACK

Impacted products

	Vendor	Product	Version
	n/a	Cisco StarOS	Version: Cisco StarOS

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T14:39:41.048Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "96913",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/96913"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-asr"
          },
          {
            "name": "1038050",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1038050"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Cisco StarOS",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Cisco StarOS"
            }
          ]
        }
      ],
      "datePublic": "2017-03-15T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "A privilege escalation vulnerability in the Secure Shell (SSH) subsystem in the StarOS operating system for Cisco ASR 5000 Series, ASR 5500 Series, ASR 5700 Series devices, and Cisco Virtualized Packet Core could allow an authenticated, remote attacker to gain unrestricted, root shell access. The vulnerability is due to missing input validation of parameters passed during SSH or SFTP login. An attacker could exploit this vulnerability by providing crafted user input to the SSH or SFTP command-line interface (CLI) during SSH or SFTP login. An exploit could allow an authenticated attacker to gain root privileges access on the router. Note: Only traffic directed to the affected system can be used to exploit this vulnerability. This vulnerability can be triggered via both IPv4 and IPv6 traffic. An established TCP connection toward port 22, the SSH default port, is needed to perform the attack. The attacker must have valid credentials to login to the system via SSH or SFTP. The following products have been confirmed to be vulnerable: Cisco ASR 5000/5500/5700 Series devices running StarOS after 17.7.0 and prior to 18.7.4, 19.5, and 20.2.3 with SSH configured are vulnerable. Cisco Virtualized Packet Core - Single Instance (VPC-SI) and Distributed Instance (VPC-DI) devices running StarOS prior to N4.2.7 (19.3.v7) and N4.7 (20.2.v0) with SSH configured are vulnerable. Cisco Bug IDs: CSCva65853."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-264",
              "description": "Privilege Escalation Vulnerability CWE-264",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-07-11T09:57:01",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "96913",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/96913"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-asr"
        },
        {
          "name": "1038050",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1038050"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@cisco.com",
          "ID": "CVE-2017-3819",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Cisco StarOS",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Cisco StarOS"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A privilege escalation vulnerability in the Secure Shell (SSH) subsystem in the StarOS operating system for Cisco ASR 5000 Series, ASR 5500 Series, ASR 5700 Series devices, and Cisco Virtualized Packet Core could allow an authenticated, remote attacker to gain unrestricted, root shell access. The vulnerability is due to missing input validation of parameters passed during SSH or SFTP login. An attacker could exploit this vulnerability by providing crafted user input to the SSH or SFTP command-line interface (CLI) during SSH or SFTP login. An exploit could allow an authenticated attacker to gain root privileges access on the router. Note: Only traffic directed to the affected system can be used to exploit this vulnerability. This vulnerability can be triggered via both IPv4 and IPv6 traffic. An established TCP connection toward port 22, the SSH default port, is needed to perform the attack. The attacker must have valid credentials to login to the system via SSH or SFTP. The following products have been confirmed to be vulnerable: Cisco ASR 5000/5500/5700 Series devices running StarOS after 17.7.0 and prior to 18.7.4, 19.5, and 20.2.3 with SSH configured are vulnerable. Cisco Virtualized Packet Core - Single Instance (VPC-SI) and Distributed Instance (VPC-DI) devices running StarOS prior to N4.2.7 (19.3.v7) and N4.7 (20.2.v0) with SSH configured are vulnerable. Cisco Bug IDs: CSCva65853."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Privilege Escalation Vulnerability CWE-264"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "96913",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/96913"
            },
            {
              "name": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-asr",
              "refsource": "CONFIRM",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-asr"
            },
            {
              "name": "1038050",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1038050"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2017-3819",
    "datePublished": "2017-03-15T20:00:00",
    "dateReserved": "2016-12-21T00:00:00",
    "dateUpdated": "2024-08-05T14:39:41.048Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted