Sign-up

ID

VAR-201606-0284


CVE

CVE-2016-1435


TITLE

Cisco IP Phone 8800 Series Unauthorized Access Vulnerability

Trust: 1.2

sources: CNVD: CNVD-2016-04236 // CNNVD: CNNVD-201606-477

DESCRIPTION

Cisco 8800 phones with software 11.0(1) do not properly enforce mounted-filesystem permissions, which allows local users to write to arbitrary files by leveraging shell access, aka Bug ID CSCuz03014. The Cisco IP Phone 8800 Series is a 8000 series IP telephony product from Cisco. The product provides voice and video capabilities. An attacker could exploit the vulnerability to gain access and modify or replace system files with malicious files. This may aid in further attacks. This issue is being tracked by Cisco bug ID CSCuz03014

Trust: 2.52

sources: NVD: CVE-2016-1435 // JVNDB: JVNDB-2016-003320 // CNVD: CNVD-2016-04236 // BID: 91321 // VULHUB: VHN-90254

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2016-04236

AFFECTED PRODUCTS

vendor:ciscomodel:ip phone 8800 seriesscope:eqversion:11.0\(1\)

Trust: 1.0

vendor:ciscomodel:ip phone 8800 seriesscope:eqversion:11.0(1)

Trust: 0.8

vendor:ciscomodel:ip phonesscope:eqversion:880011.0(1)

Trust: 0.6

vendor:ciscomodel:ip phone 8800scope: - version: -

Trust: 0.6

sources: CNVD: CNVD-2016-04236 // JVNDB: JVNDB-2016-003320 // CNNVD: CNNVD-201606-477 // NVD: CVE-2016-1435

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2016-1435
value: HIGH

Trust: 1.0

NVD: CVE-2016-1435
value: HIGH

Trust: 0.8

CNVD: CNVD-2016-04236
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201606-477
value: MEDIUM

Trust: 0.6

VULHUB: VHN-90254
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2016-1435
severity: MEDIUM
baseScore: 6.2
vectorString: AV:L/AC:H/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: HIGH
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 1.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2016-04236
severity: MEDIUM
baseScore: 6.0
vectorString: AV:L/AC:H/AU:S/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: HIGH
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 1.5
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-90254
severity: MEDIUM
baseScore: 6.2
vectorString: AV:L/AC:H/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: HIGH
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 1.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2016-1435
baseSeverity: HIGH
baseScore: 7.0
vectorString: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.0
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: CNVD: CNVD-2016-04236 // VULHUB: VHN-90254 // JVNDB: JVNDB-2016-003320 // CNNVD: CNNVD-201606-477 // NVD: CVE-2016-1435

PROBLEMTYPE DATA

problemtype:CWE-264

Trust: 1.9

sources: VULHUB: VHN-90254 // JVNDB: JVNDB-2016-003320 // NVD: CVE-2016-1435

THREAT TYPE

local

Trust: 0.9

sources: BID: 91321 // CNNVD: CNNVD-201606-477

TYPE

permissions and access control

Trust: 0.6

sources: CNNVD: CNNVD-201606-477

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2016-003320

PATCH
title:cisco-sa-20160620-ippurl:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160620-ipp
Trust: 0.8
title:CiscoIPPhone8800Series Unauthorized Access Vulnerability Patchurl:https://www.cnvd.org.cn/patchInfo/show/78006
Trust: 0.6
title:Cisco IP Phone 8800 Series Fixes for unauthorized access vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=62403
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2016-04236 // 
            
            
            
            JVNDB: JVNDB-2016-003320 // 
            
            
            
            CNNVD: CNNVD-201606-477

EXTERNAL IDS
db:NVDid:CVE-2016-1435
Trust: 3.4
db:AUSCERTid:ESB-2016.1563
Trust: 1.2
db:SECTRACKid:1036138
Trust: 1.1
db:JVNDBid:JVNDB-2016-003320
Trust: 0.8
db:CNNVDid:CNNVD-201606-477
Trust: 0.7
db:CNVDid:CNVD-2016-04236
Trust: 0.6
db:BIDid:91321
Trust: 0.3
db:VULHUBid:VHN-90254
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2016-04236 // 
            
            
            
            VULHUB: VHN-90254 // 
            
            
            
            BID: 91321 // 
            
            
            
            JVNDB: JVNDB-2016-003320 // 
            
            
            
            CNNVD: CNNVD-201606-477 // 
            
            
            
            NVD: CVE-2016-1435

REFERENCES
url:http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20160620-ipp
Trust: 2.3
url:http://www.auscert.org.au/./render.html?it=36054
Trust: 1.2
url:http://www.securitytracker.com/id/1036138
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-1435
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-1435
Trust: 0.8
url:http://www.cisco.com/
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2016-04236 // 
            
            
            
            VULHUB: VHN-90254 // 
            
            
            
            BID: 91321 // 
            
            
            
            JVNDB: JVNDB-2016-003320 // 
            
            
            
            CNNVD: CNNVD-201606-477 // 
            
            
            
            NVD: CVE-2016-1435

CREDITS
Cisco
Trust: 0.3
sources:
            
            
            BID: 91321

SOURCES
db:CNVDid:CNVD-2016-04236
db:VULHUBid:VHN-90254
db:BIDid:91321
db:JVNDBid:JVNDB-2016-003320
db:CNNVDid:CNNVD-201606-477
db:NVDid:CVE-2016-1435

LAST UPDATE DATE
2024-11-23T22:07:49.275000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2016-04236date:2016-06-23T00:00:00
db:VULHUBid:VHN-90254date:2016-11-30T00:00:00
db:BIDid:91321date:2016-07-06T15:01:00
db:JVNDBid:JVNDB-2016-003320date:2016-06-24T00:00:00
db:CNNVDid:CNNVD-201606-477date:2016-06-23T00:00:00
db:NVDid:CVE-2016-1435date:2024-11-21T02:46:26.307

SOURCES RELEASE DATE
db:CNVDid:CNVD-2016-04236date:2016-06-23T00:00:00
db:VULHUBid:VHN-90254date:2016-06-23T00:00:00
db:BIDid:91321date:2016-06-20T00:00:00
db:JVNDBid:JVNDB-2016-003320date:2016-06-24T00:00:00
db:CNNVDid:CNNVD-201606-477date:2016-06-21T00:00:00
db:NVDid:CVE-2016-1435date:2016-06-23T00:59:04.223