PT-2017-17262 · Cisco · Cisco Ultra Services Framework

Published 2017-07-06 · Updated 2017-07-13 · CVE-2017-6708

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Ultra Services Framework versions prior to 5.0.3 Cisco Ultra Services Framework versions prior to 5.1

Description A vulnerability in the symbolic link creation functionality of the AutoVNF tool could allow an unauthenticated, remote attacker to read sensitive files or execute malicious code on an affected system. The issue is due to the absence of validation checks for the input used to create symbolic links.

Recommendations For versions prior to 5.0.3, update to Release 5.0.3 or later. For versions prior to 5.1, update to Release 5.1 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-6708

Affected Products

Cisco Ultra Services Framework

References · 4

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170705-usf1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-6708 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-6708 · Security Note
• http://securityfocus.com/bid/99512 · Note