Details of VAR-201711-0347

ID

VAR-201711-0347

CVE

CVE-2017-12352

TITLE

Cisco Application Policy Infrastructure Controller Command injection vulnerability

Trust: 1.4

sources: JVNDB: JVNDB-2017-010514 // CNNVD: CNNVD-201711-1214

DESCRIPTION

A vulnerability in certain system script files that are installed at boot time on Cisco Application Policy Infrastructure Controllers could allow an authenticated, local attacker to gain elevated privileges and execute arbitrary commands with root privileges on an affected host operating system. The vulnerability is due to insufficient validation of user-controlled input that is supplied to certain script files of an affected system. An attacker could exploit this vulnerability by submitting crafted input to a script file on an affected system. A successful exploit could allow the attacker to gain elevated privileges and execute arbitrary commands with root privileges on the affected system. To exploit this vulnerability, the attacker would need to authenticate to the affected system by using valid administrator credentials. Cisco Bug IDs: CSCvf57274. Cisco Application Policy Infrastructure Controller Contains a command injection vulnerability. Vendors have confirmed this vulnerability Bug ID CSCvf57274 It is released as.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state

Trust: 1.98

sources: NVD: CVE-2017-12352 // JVNDB: JVNDB-2017-010514 // BID: 101993 // VULHUB: VHN-102866

AFFECTED PRODUCTS

vendor:	cisco	model:	application policy infrastructure controller	scope:	eq	version:	2.3\(1f\)	Trust: 1.6
vendor:	cisco	model:	application policy infrastructure controller	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	application policy infrastructure controller 2.3	scope:	-	version:	-	Trust: 0.3

sources: BID: 101993 // JVNDB: JVNDB-2017-010514 // CNNVD: CNNVD-201711-1214 // NVD: CVE-2017-12352

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-12352
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2017-12352
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201711-1214
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-102866
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2017-12352
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-102866
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2017-12352
baseSeverity:	MEDIUM
baseScore:	6.7
vectorString:	CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	0.8
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: VULHUB: VHN-102866 // JVNDB: JVNDB-2017-010514 // CNNVD: CNNVD-201711-1214 // NVD: CVE-2017-12352

PROBLEMTYPE DATA

problemtype:

CWE-77

Trust: 1.9

sources: VULHUB: VHN-102866 // JVNDB: JVNDB-2017-010514 // NVD: CVE-2017-12352

THREAT TYPE

local

Trust: 0.9

sources: BID: 101993 // CNNVD: CNNVD-201711-1214

TYPE

command injection

Trust: 0.6

sources: CNNVD: CNNVD-201711-1214

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-010514

PATCH

title:	cisco-sa-20171129-apic	url:	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171129-apic	Trust: 0.8
title:	Cisco Application Policy Infrastructure Controller Fixes for command injection vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=76832	Trust: 0.6

sources: JVNDB: JVNDB-2017-010514 // CNNVD: CNNVD-201711-1214

EXTERNAL IDS

db:	NVD	id:	CVE-2017-12352	Trust: 2.8
db:	BID	id:	101993	Trust: 2.0
db:	SECTRACK	id:	1039925	Trust: 1.7
db:	JVNDB	id:	JVNDB-2017-010514	Trust: 0.8
db:	CNNVD	id:	CNNVD-201711-1214	Trust: 0.7
db:	VULHUB	id:	VHN-102866	Trust: 0.1

sources: VULHUB: VHN-102866 // BID: 101993 // JVNDB: JVNDB-2017-010514 // CNNVD: CNNVD-201711-1214 // NVD: CVE-2017-12352

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20171129-apic	Trust: 2.0
url:	http://www.securityfocus.com/bid/101993	Trust: 1.7
url:	http://www.securitytracker.com/id/1039925	Trust: 1.7
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-12352	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2017-12352	Trust: 0.8
url:	http://www.cisco.com/	Trust: 0.3

sources: VULHUB: VHN-102866 // BID: 101993 // JVNDB: JVNDB-2017-010514 // CNNVD: CNNVD-201711-1214 // NVD: CVE-2017-12352

CREDITS

Tomas Lazauninkas of the Swedbank Security Verification Team.

Trust: 0.3

sources: BID: 101993

SOURCES

db:	VULHUB	id:	VHN-102866
db:	BID	id:	101993
db:	JVNDB	id:	JVNDB-2017-010514
db:	CNNVD	id:	CNNVD-201711-1214
db:	NVD	id:	CVE-2017-12352

LAST UPDATE DATE

2024-11-23T22:30:38.125000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-102866	date:	2019-10-09T00:00:00
db:	BID	id:	101993	date:	2017-12-19T22:37:00
db:	JVNDB	id:	JVNDB-2017-010514	date:	2017-12-15T00:00:00
db:	CNNVD	id:	CNNVD-201711-1214	date:	2019-10-17T00:00:00
db:	NVD	id:	CVE-2017-12352	date:	2024-11-21T03:09:21.860

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-102866	date:	2017-11-30T00:00:00
db:	BID	id:	101993	date:	2017-11-29T00:00:00
db:	JVNDB	id:	JVNDB-2017-010514	date:	2017-12-15T00:00:00
db:	CNNVD	id:	CNNVD-201711-1214	date:	2017-12-01T00:00:00
db:	NVD	id:	CVE-2017-12352	date:	2017-11-30T09:29:01.027