Vulnerability-Lookup

CERTA-2006-AVI-403

Vulnerability from certfr_avis - Published: 2006-09-21 - Updated: 2006-09-21

Une vulnérabilité dans CISCO IOS a été découverte et permet à des agresseurs distants de compromettre un système vulnérable.

Description

La vulnérabilité concerne le service SNMP qui devient accessible en lecture et écriture du fait de la nécessaire compatibilité avec la spécification Data Over Cable Service Interface Specification (DOCSIS). La vulnérabilité permet de prendre le contrôle d'un système vulnérable.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Cisco	N/A	CISCO IAD2432 Integrated Access Device ;
Cisco	N/A	CISCO IAD2430 Integrated Access Device ;
Cisco	N/A	CISCO MWR 1900 Mobile Wireless Edge Router ;
Cisco	N/A	CISCO VG224 Analog Phone Gateway ;
Cisco	N/A	CISCO MWR 1941 Mobile Wireless Edge Router ;
Cisco	IOS	CISCO IOS 12.3 ;
Cisco	N/A	CISCO IAD2431 Integrated Access Device ;
Cisco	IOS	CISCO IOS 12.2 ;
Cisco	IOS	CISCO IOS 12.4.

References

Title

Publication Time

Tags

Bulletins de sécurité de CISCO :

other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "CISCO IAD2432 Integrated Access Device ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "CISCO IAD2430 Integrated Access Device ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "CISCO MWR 1900 Mobile Wireless Edge Router ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "CISCO VG224 Analog Phone Gateway ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "CISCO MWR 1941 Mobile Wireless Edge Router ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "CISCO IOS 12.3 ;",
      "product": {
        "name": "IOS",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "CISCO IAD2431 Integrated Access Device ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "CISCO IOS 12.2 ;",
      "product": {
        "name": "IOS",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "CISCO IOS 12.4.",
      "product": {
        "name": "IOS",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nLa vuln\u00e9rabilit\u00e9 concerne le service SNMP qui devient accessible en\nlecture et \u00e9criture du fait de la n\u00e9cessaire compatibilit\u00e9 avec la\nsp\u00e9cification Data Over Cable Service Interface Specification (DOCSIS).\nLa vuln\u00e9rabilit\u00e9 permet de prendre le contr\u00f4le d\u0027un syst\u00e8me vuln\u00e9rable.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [],
  "initial_release_date": "2006-09-21T00:00:00",
  "last_revision_date": "2006-09-21T00:00:00",
  "links": [
    {
      "title": "Bulletins de s\u00e9curit\u00e9 de CISCO :",
      "url": "http://cisco.com/warp/public/707/cisco-sa-20060920-docsis.shtml"
    }
  ],
  "reference": "CERTA-2006-AVI-403",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2006-09-21T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 dans CISCO IOS a \u00e9t\u00e9 d\u00e9couverte et permet \u00e0 des\nagresseurs distants de compromettre un syst\u00e8me vuln\u00e9rable.\n",
  "title": "Vuln\u00e9rabilit\u00e9 CISCO IOS",
  "vendor_advisories": []
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted