Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2015.3008
Cisco Cloud Services Router 1000V Command Injection Vulnerability
3 December 2015
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Cisco Cloud Services Router 1000V Series
Publisher: Cisco Systems
Operating System: Cisco
Impact/Access: Root Compromise -- Existing Account
Resolution: Mitigation
CVE Names: CVE-2015-6385
Original Bulletin:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151130-csr
- --------------------------BEGIN INCLUDED TEXT--------------------
Cisco Cloud Services Router 1000V Command Injection Vulnerability
Medium
Advisory ID:
cisco-sa-20151130-csr
Published:
2015 November 30 22:30 GMT
Version 1.0:
Final
CVSS Score:
Base - 6.8
Workarounds:
Yes
Cisco Bug IDs:
CSCux14943
CVE-2015-6385
CWE-20
Summary
A vulnerability in the event manager environment and publish-event function of
the Cisco Cloud Services Router 1000V Series could allow an authenticated,
local attacker to perform a command injection attack with root-level
privileges.
The vulnerability is due to a lack of proper input validation of event manager
environment variables that are configured on the affected device. An attacker
could exploit this vulnerability by authenticating to the device with
administrative privileges, modifying the configuration of the device, and then
invoking a crafted event manager script. A successful exploit could allow the
attacker to compromise the affected system using commands that are executed
with root-level privileges.
Cisco has not released software updates that address this vulnerability.
Workarounds that mitigate this vulnerability are available.
This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151130-csr
Affected Products
Vulnerable Products
Cisco Cloud Services Router 1000V Series running Cisco IOS software versions
15.5(2)S and 15.5(3)S.
Products Confirmed Not Vulnerable
No other Cisco products are currently known to be affected by this
vulnerability.
Workarounds
The 'event manager environment' configuration can be removed and the
administrative password can be closely monitored.
Fixed Software
When considering software upgrades, customers are advised to consult the Cisco
Security Advisories and Responses archive at http://www.cisco.com/go/psirt and
review subsequent advisories to determine exposure and a complete upgrade
solution.
In all cases, customers should ensure that the devices to be upgraded contain
sufficient memory and confirm that current hardware and software
configurations will continue to be supported properly by the new release. If
the information is not clear, customers are advised to contact the Cisco
Technical Assistance Center (TAC) or their contracted maintenance providers.
Exploitation and Public Announcements
The Cisco Product Security Incident Response Team (PSIRT) is not aware of any
public announcements or malicious use of the vulnerability that is described
in this advisory.
URL
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151130-csr
Revision History
Version Description Section Status Date
1.0 Initial public release. Final 2015-November-30
Legal Disclaimer
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF
GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS
FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS
LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO
CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
A standalone copy or paraphrase of the text of this document that omits the
distribution URL is an uncontrolled copy and may lack important information or
contain factual errors. The information in this document is intended for end
users of Cisco products.
Cisco Security Vulnerability Policy
To learn about Cisco security vulnerability disclosure policies and
publications, see the Security Vulnerability Policy. This document also
contains instructions for obtaining fixed software and receiving security
vulnerability information from Cisco.
Subscribe to Cisco Security Notifications
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBVl+2F36ZAP0PgtI9AQIQ3BAAzdPs40jFUWqYv/A6OzfCjIZSykTV5Who
OK02+nCx1IkVPdC4qKhdT2W/X5WTCuxJXSmd9TNw8e/DD8ch8InRxts1YS4dhLHH
TJYEFe+6gvkriw2UHXMY/eZ0O+sqkRH/ct2t+vF8LnEPvsUH/kIB4drDGZL+XdAl
Q/caebBskdbgfZD4GPYZxRZD0vSM5Jmplm2E3ZctyhYksg9NApBPLa5+bM+1q1WK
ryxQDd663DXV/a/kbpNgvPqkUQqBClZXofwA1CB8RXduhse+e/V7f1Le/dev8spB
Ca7AYkGwOHfN4iI4XpJXriaUz4m25pkNqrPoIfL1OZj/e+J+XfhvDxNKW/FvLELK
UO5UqPoqu3mFuPAzuYmAIYCwuopGXOSfA5DPrBC4tSxCS8Kn5iuRjEVbj1haT6uG
18pICObX2z71L9xjeWgao+c6vDZTVr27H2yFO6ev16comXRqhpjhqmc4NgKAldFE
0EDbSVJzrTs1d3u4btW2x6iKfbywgOG92dtvBrhI/FxNshDPJXiXXTnnglx8Zxvx
P/9lYFvpbQyL5sihakO5avGX5vUsn8gNCzVsqVkzEReJPBx5mvNUbrutgQLVPC0O
e7KRhY3mvKBIdflebkp7XyzGtggp0Bt2CzKLgdRmfZSzoxpvb1lmhiZBykD+qlEu
QimiBJ2HNfo=
=qosX
-----END PGP SIGNATURE-----