PT-2017-12461 · Cisco · Cisco Expressway Series+1

Published 2017-10-19 · Updated 2019-10-09 · CVE-2017-12287

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Cisco Expressway Series Software (affected versions not specified) Cisco TelePresence Video Communication Server (VCS) Software (affected versions not specified)

Description The issue is related to incomplete input validation of URL requests by the REST API, which could allow an authenticated, remote attacker to cause the cluster database (CDB) process to restart unexpectedly. This results in a temporary denial of service (DoS) condition. An attacker could exploit this by sending a crafted URL to the REST API. A successful exploit could cause the CDB process to restart, leading to a temporary DoS condition.

Recommendations For Cisco Expressway Series Software, update to a version that includes the fix for Cisco Bug ID: CSCve77571. For Cisco TelePresence Video Communication Server (VCS) Software, update to a version that includes the fix for Cisco Bug ID: CSCve77571. As a temporary workaround, consider restricting access to the REST API to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-399

CWE-20

Related Identifiers

CVE-2017-12287

Affected Products

Cisco Expressway Series

Cisco Telepresence Video Communication Server (Vcs)

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-12287 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-expressway-tp-vcs · Vendor Advisory
• http://securityfocus.com/bid/101525 · Note
• http://securitytracker.com/id/1039626 · Note