PT-2017-17262 · Cisco · Cisco Ultra Services Framework

Publicado 2017-07-06 · Atualizado 2017-07-13 · CVE-2017-6708

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Ultra Services Framework versions prior to 5.0.3 Cisco Ultra Services Framework versions prior to 5.1

Description A vulnerability in the symbolic link creation functionality of the AutoVNF tool could allow an unauthenticated, remote attacker to read sensitive files or execute malicious code on an affected system. The issue is due to the absence of validation checks for the input used to create symbolic links.

Recommendations For versions prior to 5.0.3, update to Release 5.0.3 or later. For versions prior to 5.1, update to Release 5.1 or later.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2017-6708

Produtos afetados

Cisco Ultra Services Framework

Referências · 4

• http://securityfocus.com/bid/99512 · Nota
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170705-usf1 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-6708 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-6708 · Nota de Segurança