PT-2015-6465 · Cisco · Cisco Email Security Virtual Appliance+2

Published 2015-06-26 · Updated 2016-12-28 · CVE-2015-4217

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Web Security Virtual Appliance versions prior to 2015-06-25 Cisco Email Security Virtual Appliance versions prior to 2015-06-25 Cisco Security Management Virtual Appliance versions prior to 2015-06-25

Description The issue concerns the remote-support feature on certain Cisco virtual appliances. It uses the same default SSH host keys across different customers' installations. This makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of a private key from another installation.

Recommendations For Cisco Web Security Virtual Appliance versions prior to 2015-06-25, update to a version released after 2015-06-25 to ensure unique SSH host keys are used. For Cisco Email Security Virtual Appliance versions prior to 2015-06-25, update to a version released after 2015-06-25 to ensure unique SSH host keys are used. For Cisco Security Management Virtual Appliance versions prior to 2015-06-25, update to a version released after 2015-06-25 to ensure unique SSH host keys are used.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

CWE-310

Related Identifiers

CVE-2015-4217

Affected Products

Cisco Email Security Virtual Appliance

Cisco Security Management Virtual Appliance

Cisco Web Security Virtual Appliance

References · 6

• http://tools.cisco.com/security/center/viewAlert.x?alertId=39461 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-4217 · Security Note
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150625-ironport · Vendor Advisory
• http://securitytracker.com/id/1032726 · Note
• http://securityfocus.com/bid/75418 · Note
• http://securitytracker.com/id/1032725 · Note