PT-2017-17218 · Cisco · Cisco Identity Services Engine

Published 2017-05-22 · Updated 2019-10-03 · CVE-2017-6653

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine (ISE) version 2.1(0.474)

Description A denial of service (DoS) condition can occur on an affected device due to insufficient TCP rate limiting protection on the GUI, allowing an unauthenticated, remote attacker to cause the ISE GUI to fail to respond to new or established connection requests. This can be exploited by sending a high rate of TCP connections to the GUI, causing it to stop responding while the high rate of connections is in progress.

Recommendations For Cisco Identity Services Engine (ISE) version 2.1(0.474), consider implementing rate limiting on TCP connections to the GUI as a temporary workaround until a patch is available. Restrict access to the GUI to minimize the risk of exploitation.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

CWE-399

Related Identifiers

CVE-2017-6653

Affected Products

Cisco Identity Services Engine

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-6653 · Security Note
• https://osv.dev/vulnerability/CVE-2017-6653 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-ise · Vendor Advisory
• http://securitytracker.com/id/1038516 · Note
• http://securityfocus.com/bid/98536 · Note