Details of VAR-201711-0300

ID

VAR-201711-0300

CVE

CVE-2017-12261

TITLE

Cisco Identity Services Engine Vulnerabilities related to authorization, permissions, and access control

Trust: 0.8

sources: JVNDB: JVNDB-2017-009835

DESCRIPTION

A vulnerability in the restricted shell of the Cisco Identity Services Engine (ISE) that is accessible via SSH could allow an authenticated, local attacker to run arbitrary CLI commands with elevated privileges. The vulnerability is due to incomplete input validation of the user input for CLI commands issued at the restricted shell. An attacker could exploit this vulnerability by authenticating to the targeted device and executing commands that could lead to elevated privileges. An attacker would need valid user credentials to the device to exploit this vulnerability. The vulnerability affects the following Cisco Identity Services Engine (ISE) products running Release 1.4, 2.0, 2.0.1, 2.1.0: ISE, ISE Express, ISE Virtual Appliance. Cisco Bug IDs: CSCve74916. Vendors have confirmed this vulnerability Bug ID CSCve74916 It is released as.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The platform monitors the network by collecting real-time information on the network, users and devices, and formulating and implementing corresponding policies. Active Directory integration is one of the active directory components

Trust: 1.98

sources: NVD: CVE-2017-12261 // JVNDB: JVNDB-2017-009835 // BID: 101641 // VULHUB: VHN-102766

AFFECTED PRODUCTS

vendor:	cisco	model:	identity services engine virtual appliance	scope:	eq	version:	2.1.0	Trust: 2.7
vendor:	cisco	model:	identity services engine virtual appliance	scope:	eq	version:	1.4	Trust: 2.7
vendor:	cisco	model:	identity services engine express	scope:	eq	version:	2.0.1	Trust: 2.7
vendor:	cisco	model:	identity services engine express	scope:	eq	version:	2.0	Trust: 2.7
vendor:	cisco	model:	identity services engine express	scope:	eq	version:	1.4	Trust: 2.7
vendor:	cisco	model:	identity services engine express	scope:	eq	version:	2.1.0	Trust: 2.4
vendor:	cisco	model:	identity services engine virtual appliance	scope:	eq	version:	2.0.1	Trust: 2.1
vendor:	cisco	model:	identity services engine virtual appliance	scope:	eq	version:	2.0	Trust: 2.1
vendor:	cisco	model:	identity services engine	scope:	eq	version:	2.1.0	Trust: 1.9
vendor:	cisco	model:	identity services engine	scope:	eq	version:	2.0.1	Trust: 1.9
vendor:	cisco	model:	identity services engine	scope:	eq	version:	2.0	Trust: 1.9
vendor:	cisco	model:	identity services engine	scope:	eq	version:	1.4	Trust: 1.9
vendor:	cisco	model:	identity services engine	scope:	eq	version:	(ise) 1.4	Trust: 0.8
vendor:	cisco	model:	identity services engine	scope:	eq	version:	(ise) 2.0	Trust: 0.8
vendor:	cisco	model:	identity services engine	scope:	eq	version:	(ise) 2.0.1	Trust: 0.8
vendor:	cisco	model:	identity services engine	scope:	eq	version:	(ise) 2.1.0	Trust: 0.8
vendor:	cisco	model:	identity services engine virtual appliance	scope:	eq	version:	2.2.0	Trust: 0.3
vendor:	cisco	model:	identity services engine virtual appliance	scope:	eq	version:	1.3	Trust: 0.3
vendor:	cisco	model:	identity services engine express	scope:	eq	version:	2.2	Trust: 0.3
vendor:	cisco	model:	identity services engine express	scope:	eq	version:	2.1	Trust: 0.3
vendor:	cisco	model:	identity services engine express	scope:	eq	version:	1.3	Trust: 0.3
vendor:	cisco	model:	identity services engine series appliances	scope:	eq	version:	33002.1(102.103)	Trust: 0.3
vendor:	cisco	model:	identity services engine	scope:	eq	version:	2.2.0	Trust: 0.3
vendor:	cisco	model:	identity services engine	scope:	eq	version:	1.3	Trust: 0.3
vendor:	cisco	model:	identity services engine virtual appliance patch	scope:	ne	version:	2.2.02	Trust: 0.3
vendor:	cisco	model:	identity services engine virtual appliance patch	scope:	ne	version:	2.15	Trust: 0.3
vendor:	cisco	model:	identity services engine express patch	scope:	ne	version:	2.22	Trust: 0.3
vendor:	cisco	model:	identity services engine express patch	scope:	ne	version:	2.15	Trust: 0.3
vendor:	cisco	model:	identity services engine patch	scope:	ne	version:	2.2.02	Trust: 0.3
vendor:	cisco	model:	identity services engine patch	scope:	ne	version:	2.15	Trust: 0.3

sources: BID: 101641 // JVNDB: JVNDB-2017-009835 // CNNVD: CNNVD-201711-082 // NVD: CVE-2017-12261

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-12261
value:	HIGH
Trust: 1.0
NVD:	CVE-2017-12261
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201711-082
value:	HIGH
Trust: 0.6
VULHUB:	VHN-102766
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2017-12261
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-102766
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2017-12261
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: VULHUB: VHN-102766 // JVNDB: JVNDB-2017-009835 // CNNVD: CNNVD-201711-082 // NVD: CVE-2017-12261

PROBLEMTYPE DATA

problemtype:	CWE-264	Trust: 1.9
problemtype:	CWE-863	Trust: 1.1

sources: VULHUB: VHN-102766 // JVNDB: JVNDB-2017-009835 // NVD: CVE-2017-12261

THREAT TYPE

local

Trust: 0.9

sources: BID: 101641 // CNNVD: CNNVD-201711-082

TYPE

permissions and access control issues

Trust: 0.6

sources: CNNVD: CNNVD-201711-082

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-009835

PATCH

title:	cisco-sa-20171101-ise	url:	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171101-ise	Trust: 0.8
title:	Multiple Cisco Product Privilege License and Access Control Vulnerability Fixes	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=76085	Trust: 0.6

sources: JVNDB: JVNDB-2017-009835 // CNNVD: CNNVD-201711-082

EXTERNAL IDS

db:	NVD	id:	CVE-2017-12261	Trust: 2.8
db:	BID	id:	101641	Trust: 2.0
db:	SECTRACK	id:	1039717	Trust: 1.7
db:	JVNDB	id:	JVNDB-2017-009835	Trust: 0.8
db:	CNNVD	id:	CNNVD-201711-082	Trust: 0.7
db:	VULHUB	id:	VHN-102766	Trust: 0.1

sources: VULHUB: VHN-102766 // BID: 101641 // JVNDB: JVNDB-2017-009835 // CNNVD: CNNVD-201711-082 // NVD: CVE-2017-12261

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20171101-ise	Trust: 2.0
url:	http://www.securityfocus.com/bid/101641	Trust: 1.7
url:	http://www.securitytracker.com/id/1039717	Trust: 1.7
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-12261	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2017-12261	Trust: 0.8
url:	http://www.cisco.com/	Trust: 0.3
url:	http://www.cisco.com/en/us/products/ps11640/	Trust: 0.3

sources: VULHUB: VHN-102766 // BID: 101641 // JVNDB: JVNDB-2017-009835 // CNNVD: CNNVD-201711-082 // NVD: CVE-2017-12261

CREDITS

Anonymous security researcher.

Trust: 0.3

sources: BID: 101641

SOURCES

db:	VULHUB	id:	VHN-102766
db:	BID	id:	101641
db:	JVNDB	id:	JVNDB-2017-009835
db:	CNNVD	id:	CNNVD-201711-082
db:	NVD	id:	CVE-2017-12261

LAST UPDATE DATE

2024-11-23T22:42:01.997000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-102766	date:	2019-10-09T00:00:00
db:	BID	id:	101641	date:	2017-12-19T21:00:00
db:	JVNDB	id:	JVNDB-2017-009835	date:	2017-11-24T00:00:00
db:	CNNVD	id:	CNNVD-201711-082	date:	2019-10-17T00:00:00
db:	NVD	id:	CVE-2017-12261	date:	2024-11-21T03:09:11.287

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-102766	date:	2017-11-02T00:00:00
db:	BID	id:	101641	date:	2017-11-01T00:00:00
db:	JVNDB	id:	JVNDB-2017-009835	date:	2017-11-24T00:00:00
db:	CNNVD	id:	CNNVD-201711-082	date:	2017-11-03T00:00:00
db:	NVD	id:	CVE-2017-12261	date:	2017-11-02T16:29:00.223