PT-2015-6464 · Cisco · Cisco Email Security Virtual Appliance+2

Published 2015-06-26 · Updated 2016-12-28 · CVE-2015-4216

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Web Security Virtual Appliance versions prior to 2015-06-25 Cisco Email Security Virtual Appliance versions prior to 2015-06-25 Cisco Security Management Virtual Appliance versions prior to 2015-06-25

Description The issue concerns the remote-support feature on certain Cisco virtual appliances. It uses the same default SSH root authorized key across different customers' installations. This makes it easier for remote attackers to bypass authentication by leveraging knowledge of a private key from another installation.

Recommendations For Cisco Web Security Virtual Appliance versions prior to 2015-06-25, update to a version released after 2015-06-25 to ensure a unique SSH root authorized key is used. For Cisco Email Security Virtual Appliance versions prior to 2015-06-25, update to a version released after 2015-06-25 to ensure a unique SSH root authorized key is used. For Cisco Security Management Virtual Appliance versions prior to 2015-06-25, update to a version released after 2015-06-25 to ensure a unique SSH root authorized key is used.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2015-4216

Affected Products

Cisco Email Security Virtual Appliance

Cisco Security Management Virtual Appliance

Cisco Web Security Virtual Appliance

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2015-4216 · Security Note
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150625-ironport · Vendor Advisory
• http://securitytracker.com/id/1032726 · Note
• http://securityfocus.com/bid/75417 · Note
• http://securitytracker.com/id/1032725 · Note