PT-2014-8362 · Cisco · Cisco Ios Xe

Publicado 2014-11-06 · Atualizado 2017-09-08 · CVE-2014-7990

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS XE versions 3.5E and earlier

Description A vulnerability exists due to improper parsing of the challenge response in the request system shell command. This allows an authenticated, local attacker with administrative privilege to access the underlying Linux root shell by entering a crafted challenge response. The vulnerability can be exploited if the service internal command is configured, which is not recommended. To exploit this vulnerability, an attacker must authenticate and have local access to the targeted device.

Recommendations For Cisco IOS XE versions 3.5E and earlier, consider disabling the request system shell command until a patch is available, as software updates are not currently available. Additionally, avoid configuring the service internal command to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2014-7990

Produtos afetados

Cisco Ios Xe

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2014-7990 · Nota de Segurança
• http://securitytracker.com/id/1031179 · Nota
• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-7990 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/98529 · Nota
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20141106-CVE-2014-7990 · Aviso do Fabricante
• http://tools.cisco.com/security/center/viewAlert.x?alertId=36351 · Aviso do Fabricante
• http://securityfocus.com/bid/70968 · Nota