Sign-up

ID

VAR-201803-1604


CVE

CVE-2018-0184


TITLE

Cisco IOS XE Vulnerability related to authorization, authority, and access control in software

Trust: 0.8

sources: JVNDB: JVNDB-2018-003430

DESCRIPTION

A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to gain access to the underlying Linux shell of an affected device and execute arbitrary commands with root privileges on the device. The vulnerability is due to the affected software improperly sanitizing command arguments to prevent access to internal data structures on a device. An attacker who has privileged EXEC mode (privilege level 15) access to an affected device could exploit this vulnerability on the device by executing CLI commands that contain crafted arguments. A successful exploit could allow the attacker to gain access to the underlying Linux shell of the affected device and execute arbitrary commands with root privileges on the device. Cisco Bug IDs: CSCve74432. Cisco IOS XE The software contains vulnerabilities related to authorization, permissions, and access control. Vendors have confirmed this vulnerability Bug ID CSCve74432 It is released as.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. This may aid in further attacks. CLI parser is one of the command line command parsers. The vulnerability is caused by the program not filtering command parameters correctly

Trust: 1.98

sources: NVD: CVE-2018-0184 // JVNDB: JVNDB-2018-003430 // BID: 103550 // VULHUB: VHN-118386

AFFECTED PRODUCTS

vendor:ciscomodel:ios xescope:ltversion:16.6.2

Trust: 1.0

vendor:ciscomodel:ios xescope:ltversion:3.8.6e

Trust: 1.0

vendor:ciscomodel:ios xescope:gteversion:16.3

Trust: 1.0

vendor:ciscomodel:ios xescope:ltversion:3.13.9s

Trust: 1.0

vendor:ciscomodel:ios xescope:ltversion:3.16.7s

Trust: 1.0

vendor:ciscomodel:ios xescope:gteversion:16.6

Trust: 1.0

vendor:ciscomodel:ios xescope:ltversion:16.3.6

Trust: 1.0

vendor:ciscomodel:ios xescope: - version: -

Trust: 0.8

vendor:ciscomodel:ios xescope:eqversion:2.1.2

Trust: 0.6

vendor:ciscomodel:ios xescope:eqversion:2.1.1

Trust: 0.6

vendor:ciscomodel:ios xescope:eqversion:2.3.0t

Trust: 0.6

vendor:ciscomodel:ios xescope:eqversion:2.2.3

Trust: 0.6

vendor:ciscomodel:ios xescope:eqversion:2.2.1

Trust: 0.6

vendor:ciscomodel:ios xescope:eqversion:2.1.0

Trust: 0.6

vendor:ciscomodel:ios xescope:eqversion:16.3.4

Trust: 0.6

vendor:ciscomodel:ios xescope:eqversion:2.3.0

Trust: 0.6

vendor:ciscomodel:ios xescope:eqversion: -

Trust: 0.6

vendor:ciscomodel:ios xescope:eqversion:2.2.2

Trust: 0.6

vendor:ciscomodel:ios xe softwarescope:eqversion:0

Trust: 0.3

vendor:ciscomodel:ios everest-16.5.1scope: - version: -

Trust: 0.3

vendor:ciscomodel:iosscope:eqversion:0

Trust: 0.3

sources: BID: 103550 // JVNDB: JVNDB-2018-003430 // CNNVD: CNNVD-201803-1011 // NVD: CVE-2018-0184

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-0184
value: MEDIUM

Trust: 1.0

NVD: CVE-2018-0184
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201803-1011
value: MEDIUM

Trust: 0.6

VULHUB: VHN-118386
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2018-0184
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-118386
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2018-0184
baseSeverity: MEDIUM
baseScore: 6.7
vectorString: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 0.8
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-118386 // JVNDB: JVNDB-2018-003430 // CNNVD: CNNVD-201803-1011 // NVD: CVE-2018-0184

PROBLEMTYPE DATA

problemtype:CWE-264

Trust: 1.9

problemtype:CWE-78

Trust: 1.1

sources: VULHUB: VHN-118386 // JVNDB: JVNDB-2018-003430 // NVD: CVE-2018-0184

THREAT TYPE

local

Trust: 0.9

sources: BID: 103550 // CNNVD: CNNVD-201803-1011

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-201803-1011

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-003430

PATCH
title:cisco-sa-20180328-privesc2url:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-privesc2
Trust: 0.8
title:Cisco IOS XE Software CLI Fixes for resolver permissions and access control vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=79479
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2018-003430 // 
            
            
            
            CNNVD: CNNVD-201803-1011

EXTERNAL IDS
db:NVDid:CVE-2018-0184
Trust: 2.8
db:BIDid:103550
Trust: 2.0
db:JVNDBid:JVNDB-2018-003430
Trust: 0.8
db:CNNVDid:CNNVD-201803-1011
Trust: 0.7
db:VULHUBid:VHN-118386
Trust: 0.1
sources:
            
            
            VULHUB: VHN-118386 // 
            
            
            
            BID: 103550 // 
            
            
            
            JVNDB: JVNDB-2018-003430 // 
            
            
            
            CNNVD: CNNVD-201803-1011 // 
            
            
            
            NVD: CVE-2018-0184

REFERENCES
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20180328-privesc2
Trust: 2.0
url:http://www.securityfocus.com/bid/103550
Trust: 1.7
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-0184
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2018-0184
Trust: 0.8
url:http://www.cisco.com/
Trust: 0.3
sources:
            
            
            VULHUB: VHN-118386 // 
            
            
            
            BID: 103550 // 
            
            
            
            JVNDB: JVNDB-2018-003430 // 
            
            
            
            CNNVD: CNNVD-201803-1011 // 
            
            
            
            NVD: CVE-2018-0184

CREDITS
Cisco.
Trust: 0.3
sources:
            
            
            BID: 103550

SOURCES
db:VULHUBid:VHN-118386
db:BIDid:103550
db:JVNDBid:JVNDB-2018-003430
db:CNNVDid:CNNVD-201803-1011
db:NVDid:CVE-2018-0184

LAST UPDATE DATE
2024-11-23T22:26:26.530000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-118386date:2019-10-09T00:00:00
db:BIDid:103550date:2018-03-28T00:00:00
db:JVNDBid:JVNDB-2018-003430date:2018-05-23T00:00:00
db:CNNVDid:CNNVD-201803-1011date:2019-10-17T00:00:00
db:NVDid:CVE-2018-0184date:2024-11-21T03:37:41.147

SOURCES RELEASE DATE
db:VULHUBid:VHN-118386date:2018-03-28T00:00:00
db:BIDid:103550date:2018-03-28T00:00:00
db:JVNDBid:JVNDB-2018-003430date:2018-05-23T00:00:00
db:CNNVDid:CNNVD-201803-1011date:2018-03-29T00:00:00
db:NVDid:CVE-2018-0184date:2018-03-28T22:29:01.767