PT-2017-2440 · Cisco · Cisco Ios Xr

Publicado 2017-06-21 · Atualizado 2017-07-07 · CVE-2017-6719

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS XR Software version 6.2.1.BASE Cisco IOS XR Software versions prior to 6.2.1.28i.BASE Cisco IOS XR Software versions prior to 6.2.1.22i.BASE Cisco IOS XR Software versions prior to 6.1.32.8i.BASE Cisco IOS XR Software versions prior to 6.1.31.3i.BASE Cisco IOS XR Software versions prior to 6.1.3.10i.BASE

Description A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to execute arbitrary commands on the host operating system with root privileges. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to a command in a specific group. A successful exploit could allow the attacker to execute arbitrary commands on the affected system with root privileges.

Recommendations For version 6.2.1.BASE, update to version 6.2.1.28i.BASE or later. For versions prior to 6.2.1.22i.BASE, update to version 6.2.1.22i.BASE or later. For versions prior to 6.1.32.8i.BASE, update to version 6.1.32.8i.BASE or later. For versions prior to 6.1.31.3i.BASE, update to version 6.1.31.3i.BASE or later. For versions prior to 6.1.3.10i.BASE, update to version 6.1.3.10i.BASE or later.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2017-01645

CVE-2017-6719

Produtos afetados

Cisco Ios Xr

Referências · 6

• http://securitytracker.com/id/1038741 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-6719 · Nota de Segurança
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170621-ios · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-6719 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2017-01645 · Nota de Segurança
• http://securityfocus.com/bid/99213 · Nota