Details of VAR-201703-0711

ID

VAR-201703-0711

CVE

CVE-2017-3819

TITLE

Cisco ASR 5000 Series devices and Virtualized Packet Core of StarOS Vulnerabilities related to authorization, permissions, and access control

Trust: 0.8

sources: JVNDB: JVNDB-2017-002733

DESCRIPTION

A privilege escalation vulnerability in the Secure Shell (SSH) subsystem in the StarOS operating system for Cisco ASR 5000 Series, ASR 5500 Series, ASR 5700 Series devices, and Cisco Virtualized Packet Core could allow an authenticated, remote attacker to gain unrestricted, root shell access. The vulnerability is due to missing input validation of parameters passed during SSH or SFTP login. An attacker could exploit this vulnerability by providing crafted user input to the SSH or SFTP command-line interface (CLI) during SSH or SFTP login. An exploit could allow an authenticated attacker to gain root privileges access on the router. Note: Only traffic directed to the affected system can be used to exploit this vulnerability. This vulnerability can be triggered via both IPv4 and IPv6 traffic. An established TCP connection toward port 22, the SSH default port, is needed to perform the attack. The attacker must have valid credentials to login to the system via SSH or SFTP. The following products have been confirmed to be vulnerable: Cisco ASR 5000/5500/5700 Series devices running StarOS after 17.7.0 and prior to 18.7.4, 19.5, and 20.2.3 with SSH configured are vulnerable. Cisco Virtualized Packet Core - Single Instance (VPC-SI) and Distributed Instance (VPC-DI) devices running StarOS prior to N4.2.7 (19.3.v7) and N4.7 (20.2.v0) with SSH configured are vulnerable. Cisco Bug IDs: CSCva65853. Vendors have confirmed this vulnerability Bug ID CSCva65853 It is released as.Information is obtained, information is altered, and service operation is disrupted (DoS) An attack may be carried out. CiscoStarOS is a set of operating systems operated by Cisco Systems Inc. in a series of routers such as 5000. A privilege elevation vulnerability exists in CiscoStarOS. Cisco StarOS is prone to a privilege-escalation vulnerability. Cisco ASR 5500 Series and so on are the 5500 and other series router equipment of Cisco (Cisco). There is a privilege escalation vulnerability in the SSH subsystem of the StarOS operating system in many Cisco products. Cisco has released software updates that address this vulnerability. Workarounds that mitigate this vulnerability are not available. This advisory is available at the following link: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-asr ["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-asr"] -----BEGIN PGP SIGNATURE----- iQKBBAEBAgBrBQJYyWVsZBxDaXNjbyBTeXN0ZW1zIFByb2R1Y3QgU2VjdXJpdHkg SW5jaWRlbnQgUmVzcG9uc2UgVGVhbSAoQ2lzY28gUFNJUlQga2V5IDIwMTYtMjAx NykgPHBzaXJ0QGNpc2NvLmNvbT4ACgkQrz2APcQAkHlB4A//abxGCJXva4/bR/wn 5QMis+qjShEQId3TAqA3+YFFP4u1JGAFRDm77ieE0vJVSYDWJ3hGSNttYq1Pt+e0 yMCbX1pXSN29nNvoTL2yORnYGBhYKEK2MmJXpjz0exPh4r+Is5s+JAB2bIJdVMip e4pPLOkZm8B008/7OgkCdBqY5TEo3X41m5HTq7RYSglf5pTfkM6O04U8pEIh8KOv oi9gI3JVTj/Yh7EtJkLU6CNygg6INfY9B9EUV5Ctfus7AZfvPLzdG4Jl+57mrPWl tKCgCLsSUYvW/28TlRP72pwVoKWzLg2zhW1j98GAwUIfQXw6bt9jgAma2p8ZTiCa 5LMWmOsrvaw8G6jfxr3ligTxoSGRikXfItZIMkWe0YuiS9aXQBwdcu7WwSyneM0J vtYqSsF/ktsMRrE3YhtrUw6GmQ/5zw9FsizcWWG2O4kAd0U02E+Mw+aPi7HvN92G +fPO0OaWakr4fAfxWF2rPcEnGg8idPT6BbSLvf+B330GPOiYGZP0M4kJwxZe7t25 obpM3LJptZjN129fOGj/GlC4e+xYc+UOug/8lgyRR4Q9znSjd8o0lSyFQfcIwOmt 8NETMaT9p8CLyUyvyQ1/S4XyP3RriqTjn8OE6lq71ZRGpRIQ6N8xIVxaD0OBDcks g41Iqe0GD5yQFsXypTAn7dc9bNg= =Lk6U -----END PGP SIGNATURE-----

Trust: 2.61

sources: NVD: CVE-2017-3819 // JVNDB: JVNDB-2017-002733 // CNVD: CNVD-2017-03298 // BID: 96913 // VULHUB: VHN-112022 // PACKETSTORM: 141659

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2017-03298

AFFECTED PRODUCTS

vendor:	cisco	model:	asr 5000 series software	scope:	eq	version:	18.1.0	Trust: 1.6
vendor:	cisco	model:	asr 5000 series software	scope:	eq	version:	18.0.0.59211	Trust: 1.6
vendor:	cisco	model:	asr 5000 series software	scope:	eq	version:	18.0.l0.59219	Trust: 1.6
vendor:	cisco	model:	virtualized packet core	scope:	eq	version:	v20.0_base	Trust: 1.6
vendor:	cisco	model:	asr 5000 series software	scope:	eq	version:	19.0.m0.60828	Trust: 1.6
vendor:	cisco	model:	asr 5000 series software	scope:	eq	version:	19.2.0	Trust: 1.6
vendor:	cisco	model:	asr 5000 series software	scope:	eq	version:	19.0.m0.60737	Trust: 1.6
vendor:	cisco	model:	asr 5000 series software	scope:	eq	version:	18.1.0.59776	Trust: 1.6
vendor:	cisco	model:	virtualized packet core	scope:	eq	version:	v18.0_base	Trust: 1.6
vendor:	cisco	model:	virtualized packet core	scope:	eq	version:	v19.0_base	Trust: 1.6
vendor:	cisco	model:	asr 5000 series software	scope:	eq	version:	18.3.0	Trust: 1.0
vendor:	cisco	model:	asr 5000 series software	scope:	eq	version:	19.3.0	Trust: 1.0
vendor:	cisco	model:	asr 5000 series software	scope:	eq	version:	19.1.0.61559	Trust: 1.0
vendor:	cisco	model:	asr 5000 series software	scope:	eq	version:	18.0.0.59167	Trust: 1.0
vendor:	cisco	model:	asr 5000 series software	scope:	eq	version:	18.0.0	Trust: 1.0
vendor:	cisco	model:	asr 5000 series software	scope:	eq	version:	18.4.0	Trust: 1.0
vendor:	cisco	model:	asr 5000 series software	scope:	eq	version:	18.0.0.57828	Trust: 1.0
vendor:	cisco	model:	asr 5000 series software	scope:	eq	version:	19.0.1	Trust: 1.0
vendor:	cisco	model:	asr 5000 series software	scope:	eq	version:	20.0.0	Trust: 1.0
vendor:	cisco	model:	asr 5000 series software	scope:	eq	version:	18.3_base	Trust: 1.0
vendor:	cisco	model:	asr 5000 series software	scope:	eq	version:	19.0.m0.61045	Trust: 1.0
vendor:	cisco	model:	asr 5000 series software	scope:	eq	version:	18.1.0.59780	Trust: 1.0
vendor:	cisco	model:	asr 5000 series software	scope:	eq	version:	18.1_base	Trust: 1.0
vendor:	cisco	model:	asr 5000 series software	scope:	eq	version:	19.1.0	Trust: 1.0
vendor:	cisco	model:	asr series	scope:	eq	version:	50000	Trust: 0.9
vendor:	cisco	model:	staros	scope:	eq	version:	20.0	Trust: 0.9
vendor:	cisco	model:	staros	scope:	eq	version:	19.0	Trust: 0.9
vendor:	cisco	model:	staros	scope:	eq	version:	18.0	Trust: 0.9
vendor:	cisco	model:	staros	scope:	eq	version:	17.0	Trust: 0.9
vendor:	cisco	model:	asr series	scope:	eq	version:	57000	Trust: 0.9
vendor:	cisco	model:	asr series	scope:	eq	version:	55000	Trust: 0.9
vendor:	cisco	model:	virtualized packet core software n4.7	scope:	eq	version:	(20.2)	Trust: 0.9
vendor:	cisco	model:	virtualized packet core software n4.6	scope:	eq	version:	(20.1)	Trust: 0.9
vendor:	cisco	model:	virtualized packet core software n4.5	scope:	eq	version:	(20.0)	Trust: 0.9
vendor:	cisco	model:	virtualized packet core software n4.2	scope:	eq	version:	(19.3)	Trust: 0.9
vendor:	cisco	model:	virtualized packet core software n4.0	scope:	eq	version:	(19.2)	Trust: 0.9
vendor:	cisco	model:	asr 5000 series software	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	virtualized packet core	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	staros	scope:	ne	version:	20.2.3	Trust: 0.3
vendor:	cisco	model:	staros	scope:	ne	version:	18.7.4	Trust: 0.3
vendor:	cisco	model:	staros	scope:	ne	version:	19.5	Trust: 0.3

sources: CNVD: CNVD-2017-03298 // BID: 96913 // JVNDB: JVNDB-2017-002733 // CNNVD: CNNVD-201703-638 // NVD: CVE-2017-3819

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-3819
value:	HIGH
Trust: 1.0
NVD:	CVE-2017-3819
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2017-03298
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201703-638
value:	HIGH
Trust: 0.6
VULHUB:	VHN-112022
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2017-3819
severity:	HIGH
baseScore:	9.0
vectorString:	AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2017-03298
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-112022
severity:	HIGH
baseScore:	9.0
vectorString:	AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2017-3819
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: CNVD: CNVD-2017-03298 // VULHUB: VHN-112022 // JVNDB: JVNDB-2017-002733 // CNNVD: CNNVD-201703-638 // NVD: CVE-2017-3819

PROBLEMTYPE DATA

problemtype:	CWE-264	Trust: 1.9
problemtype:	CWE-306	Trust: 1.1

sources: VULHUB: VHN-112022 // JVNDB: JVNDB-2017-002733 // NVD: CVE-2017-3819

THREAT TYPE

remote

Trust: 0.7

sources: PACKETSTORM: 141659 // CNNVD: CNNVD-201703-638

TYPE

access control error

Trust: 0.6

sources: CNNVD: CNNVD-201703-638

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-002733

EXPLOIT AVAILABILITY

sources: VULHUB: VHN-112022

PATCH

title:	cisco-sa-20170315-asr	url:	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-asr	Trust: 0.8
title:	Patch for CiscoStarOS Privilege Escalation Vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/90837	Trust: 0.6
title:	Multiple Cisco product StarOS Fixes for permission permissions and access control vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=68499	Trust: 0.6

sources: CNVD: CNVD-2017-03298 // JVNDB: JVNDB-2017-002733 // CNNVD: CNNVD-201703-638

EXTERNAL IDS

db:	NVD	id:	CVE-2017-3819	Trust: 3.5
db:	BID	id:	96913	Trust: 2.6
db:	SECTRACK	id:	1038050	Trust: 1.7
db:	JVNDB	id:	JVNDB-2017-002733	Trust: 0.8
db:	CNNVD	id:	CNNVD-201703-638	Trust: 0.7
db:	CNVD	id:	CNVD-2017-03298	Trust: 0.6
db:	PACKETSTORM	id:	141659	Trust: 0.2
db:	VULHUB	id:	VHN-112022	Trust: 0.1

sources: CNVD: CNVD-2017-03298 // VULHUB: VHN-112022 // BID: 96913 // JVNDB: JVNDB-2017-002733 // PACKETSTORM: 141659 // CNNVD: CNNVD-201703-638 // NVD: CVE-2017-3819

REFERENCES

url:	http://www.securityfocus.com/bid/96913	Trust: 2.3
url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20170315-asr	Trust: 2.1
url:	http://www.securitytracker.com/id/1038050	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2017-3819	Trust: 0.9
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-3819	Trust: 0.8
url:	http://www.cisco.com/	Trust: 0.3
url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20170315-asr"]	Trust: 0.1

sources: CNVD: CNVD-2017-03298 // VULHUB: VHN-112022 // BID: 96913 // JVNDB: JVNDB-2017-002733 // PACKETSTORM: 141659 // CNNVD: CNNVD-201703-638 // NVD: CVE-2017-3819

CREDITS

Cisco

Trust: 0.3

sources: BID: 96913

SOURCES

db:	CNVD	id:	CNVD-2017-03298
db:	VULHUB	id:	VHN-112022
db:	BID	id:	96913
db:	JVNDB	id:	JVNDB-2017-002733
db:	PACKETSTORM	id:	141659
db:	CNNVD	id:	CNNVD-201703-638
db:	NVD	id:	CVE-2017-3819

LAST UPDATE DATE

2024-11-23T22:49:08.028000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2017-03298	date:	2017-03-24T00:00:00
db:	VULHUB	id:	VHN-112022	date:	2019-10-03T00:00:00
db:	BID	id:	96913	date:	2017-03-16T00:03:00
db:	JVNDB	id:	JVNDB-2017-002733	date:	2017-04-26T00:00:00
db:	CNNVD	id:	CNNVD-201703-638	date:	2019-10-23T00:00:00
db:	NVD	id:	CVE-2017-3819	date:	2024-11-21T03:26:10.663

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2017-03298	date:	2017-03-24T00:00:00
db:	VULHUB	id:	VHN-112022	date:	2017-03-15T00:00:00
db:	BID	id:	96913	date:	2017-03-15T00:00:00
db:	JVNDB	id:	JVNDB-2017-002733	date:	2017-04-26T00:00:00
db:	PACKETSTORM	id:	141659	date:	2017-03-16T00:03:51
db:	CNNVD	id:	CNNVD-201703-638	date:	2017-03-28T00:00:00
db:	NVD	id:	CVE-2017-3819	date:	2017-03-15T20:59:00.147