Details of VAR-201612-0369

ID

VAR-201612-0369

CVE

CVE-2016-9207

TITLE

Cisco Expressway of HTTP For any host in the traffic server component TCP Vulnerability that initiates a connection

Trust: 0.8

sources: JVNDB: JVNDB-2016-006320

DESCRIPTION

A vulnerability in the HTTP traffic server component of Cisco Expressway could allow an unauthenticated, remote attacker to initiate TCP connections to arbitrary hosts. This does not allow for full traffic proxy through the Expressway. Affected Products: This vulnerability affects Cisco Expressway Series Software and Cisco TelePresence Video Communication Server (VCS). More Information: CSCvc10834. Known Affected Releases: X8.7.2 X8.8.3. Known Fixed Releases: X8.9. Vendors have confirmed this vulnerability CSCvc10834 It is released as.By remote attacker, against any host TCP Connection may be started. Multiple Cisco Products are prone to a security-bypass vulnerability. Successful exploits may allow an attacker to bypass certain security restrictions to perform unauthorized actions. This may aid in further attacks. This issue is tracked by Cisco Bug ID CSCvc10834

Trust: 1.98

sources: NVD: CVE-2016-9207 // JVNDB: JVNDB-2016-006320 // BID: 94797 // VULHUB: VHN-98027

AFFECTED PRODUCTS

vendor:	cisco	model:	expressway	scope:	eq	version:	x8.7.2	Trust: 1.6
vendor:	cisco	model:	expressway	scope:	eq	version:	x8.8.3	Trust: 1.6
vendor:	cisco	model:	expressway software	scope:	eq	version:	x8.7.2	Trust: 0.8
vendor:	cisco	model:	expressway software	scope:	eq	version:	x8.8.3	Trust: 0.8
vendor:	cisco	model:	telepresence video communication server software	scope:	eq	version:	x8.7.2	Trust: 0.8
vendor:	cisco	model:	telepresence video communication server software	scope:	eq	version:	x8.8.3	Trust: 0.8
vendor:	cisco	model:	telepresence video communication server	scope:	eq	version:	0	Trust: 0.3
vendor:	cisco	model:	expressway series software	scope:	eq	version:	0	Trust: 0.3

sources: BID: 94797 // JVNDB: JVNDB-2016-006320 // CNNVD: CNNVD-201612-271 // NVD: CVE-2016-9207

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2016-9207
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2016-9207
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201612-271
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-98027
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2016-9207
severity:	MEDIUM
baseScore:	6.4
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-98027
severity:	MEDIUM
baseScore:	6.4
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2016-9207
baseSeverity:	MEDIUM
baseScore:	6.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	NONE
availabilityImpact:	LOW
exploitabilityScore:	3.9
impactScore:	2.5
version:	3.0
Trust: 1.8

sources: VULHUB: VHN-98027 // JVNDB: JVNDB-2016-006320 // CNNVD: CNNVD-201612-271 // NVD: CVE-2016-9207

PROBLEMTYPE DATA

problemtype:	CWE-20	Trust: 1.9
problemtype:	CWE-254	Trust: 1.9

sources: VULHUB: VHN-98027 // JVNDB: JVNDB-2016-006320 // NVD: CVE-2016-9207

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201612-271

TYPE

input validation

Trust: 0.6

sources: CNNVD: CNNVD-201612-271

CONFIGURATIONS

sources: JVNDB: JVNDB-2016-006320

PATCH

title:	cisco-sa-20161207-expressway	url:	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161207-expressway	Trust: 0.8
title:	Multiple Cisco Product security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=66311	Trust: 0.6

sources: JVNDB: JVNDB-2016-006320 // CNNVD: CNNVD-201612-271

EXTERNAL IDS

db:	NVD	id:	CVE-2016-9207	Trust: 2.8
db:	BID	id:	94797	Trust: 2.0
db:	SECTRACK	id:	1037422	Trust: 1.1
db:	JVNDB	id:	JVNDB-2016-006320	Trust: 0.8
db:	CNNVD	id:	CNNVD-201612-271	Trust: 0.7
db:	VULHUB	id:	VHN-98027	Trust: 0.1

sources: VULHUB: VHN-98027 // BID: 94797 // JVNDB: JVNDB-2016-006320 // CNNVD: CNNVD-201612-271 // NVD: CVE-2016-9207

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20161207-expressway	Trust: 2.0
url:	http://www.securityfocus.com/bid/94797	Trust: 1.7
url:	http://www.securitytracker.com/id/1037422	Trust: 1.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-9207	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-9207	Trust: 0.8
url:	http://www.cisco.com/	Trust: 0.3

sources: VULHUB: VHN-98027 // BID: 94797 // JVNDB: JVNDB-2016-006320 // CNNVD: CNNVD-201612-271 // NVD: CVE-2016-9207

CREDITS

Micha Borrmann of SySS.

Trust: 0.9

sources: BID: 94797 // CNNVD: CNNVD-201612-271

SOURCES

db:	VULHUB	id:	VHN-98027
db:	BID	id:	94797
db:	JVNDB	id:	JVNDB-2016-006320
db:	CNNVD	id:	CNNVD-201612-271
db:	NVD	id:	CVE-2016-9207

LAST UPDATE DATE

2024-11-23T22:38:42.641000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-98027	date:	2016-12-22T00:00:00
db:	BID	id:	94797	date:	2016-12-20T01:08:00
db:	JVNDB	id:	JVNDB-2016-006320	date:	2016-12-21T00:00:00
db:	CNNVD	id:	CNNVD-201612-271	date:	2016-12-13T00:00:00
db:	NVD	id:	CVE-2016-9207	date:	2024-11-21T03:00:48.060

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-98027	date:	2016-12-14T00:00:00
db:	BID	id:	94797	date:	2016-12-07T00:00:00
db:	JVNDB	id:	JVNDB-2016-006320	date:	2016-12-21T00:00:00
db:	CNNVD	id:	CNNVD-201612-271	date:	2016-12-12T00:00:00
db:	NVD	id:	CVE-2016-9207	date:	2016-12-14T00:59:28.693