Vulnerability-Lookup

CNVD-2017-04002

Vulnerability from cnvd - Published: 2017-04-06

Title

多个Cisco产品栈缓冲区溢出漏洞

Description

Cisco IOS和Cisco IOx Software都是美国思科（Cisco）公司为其网络设备开发的操作系统。多个Cisco产品存在栈缓冲区溢出漏洞，该漏洞源于将用户数据复制到大小不足的缓冲区前未能进行充分的边界检查。攻击者可以在受影响的应用环境中执行任意代码，失败的攻击会造成拒绝服务。

Severity

高

Patch Name

多个Cisco产品栈缓冲区溢出漏洞的补丁

Patch Description

Cisco IOS和Cisco IOx Software都是美国思科（Cisco）公司为其网络设备开发的操作系统。多个Cisco产品存在栈缓冲区溢出漏洞，该漏洞源于将用户数据复制到大小不足的缓冲区前未能进行充分的边界检查。攻击者可以在受影响的应用环境中执行任意代码，失败的攻击会造成拒绝服务。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： http://seclists.org/bugtraq/2017/Mar/82

Reference

http://seclists.org/bugtraq/2017/Mar/82 https://threatpost.com/cisco-patches-critical-iox-vulnerability/124533/ https://nvd.nist.gov/vuln/detail/CVE-2017-3853 http://www.securityfocus.com/bid/97011

Impacted products

Name
Cisco IOx <1.1.0

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "97011"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-3853"
    }
  },
  "description": "Cisco IOS\u548cCisco IOx Software\u90fd\u662f\u7f8e\u56fd\u601d\u79d1\uff08Cisco\uff09\u516c\u53f8\u4e3a\u5176\u7f51\u7edc\u8bbe\u5907\u5f00\u53d1\u7684\u64cd\u4f5c\u7cfb\u7edf\u3002\r\n\r\n\u591a\u4e2aCisco\u4ea7\u54c1\u5b58\u5728\u6808\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5c06\u7528\u6237\u6570\u636e\u590d\u5236\u5230\u5927\u5c0f\u4e0d\u8db3\u7684\u7f13\u51b2\u533a\u524d\u672a\u80fd\u8fdb\u884c\u5145\u5206\u7684\u8fb9\u754c\u68c0\u67e5\u3002\u653b\u51fb\u8005\u53ef\u4ee5\u5728\u53d7\u5f71\u54cd\u7684\u5e94\u7528\u73af\u5883\u4e2d\u6267\u884c\u4efb\u610f\u4ee3\u7801\uff0c\u5931\u8d25\u7684\u653b\u51fb\u4f1a\u9020\u6210\u62d2\u7edd\u670d\u52a1\u3002",
  "discovererName": "Cisco",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttp://seclists.org/bugtraq/2017/Mar/82",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-04002",
  "openTime": "2017-04-06",
  "patchDescription": "Cisco IOS\u548cCisco IOx Software\u90fd\u662f\u7f8e\u56fd\u601d\u79d1\uff08Cisco\uff09\u516c\u53f8\u4e3a\u5176\u7f51\u7edc\u8bbe\u5907\u5f00\u53d1\u7684\u64cd\u4f5c\u7cfb\u7edf\u3002\r\n\r\n\u591a\u4e2aCisco\u4ea7\u54c1\u5b58\u5728\u6808\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5c06\u7528\u6237\u6570\u636e\u590d\u5236\u5230\u5927\u5c0f\u4e0d\u8db3\u7684\u7f13\u51b2\u533a\u524d\u672a\u80fd\u8fdb\u884c\u5145\u5206\u7684\u8fb9\u754c\u68c0\u67e5\u3002\u653b\u51fb\u8005\u53ef\u4ee5\u5728\u53d7\u5f71\u54cd\u7684\u5e94\u7528\u73af\u5883\u4e2d\u6267\u884c\u4efb\u610f\u4ee3\u7801\uff0c\u5931\u8d25\u7684\u653b\u51fb\u4f1a\u9020\u6210\u62d2\u7edd\u670d\u52a1\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "\u591a\u4e2aCisco\u4ea7\u54c1\u6808\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Cisco IOx \u003c1.1.0"
  },
  "referenceLink": "http://seclists.org/bugtraq/2017/Mar/82\r\nhttps://threatpost.com/cisco-patches-critical-iox-vulnerability/124533/\r\nhttps://nvd.nist.gov/vuln/detail/CVE-2017-3853\r\nhttp://www.securityfocus.com/bid/97011",
  "serverity": "\u9ad8",
  "submitTime": "2017-03-23",
  "title": "\u591a\u4e2aCisco\u4ea7\u54c1\u6808\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e"
}

CVE-2017-3853 (GCVE-0-2017-3853)

Vulnerability from cvelistv5 – Published: 2017-03-22 19:00 – Updated: 2024-08-05 14:39

Summary

A vulnerability in the Data-in-Motion (DMo) process installed with the Cisco IOx application environment could allow an unauthenticated, remote attacker to cause a stack overflow that could allow remote code execution with root privileges in the virtual instance running on an affected device. The vulnerability is due to insufficient bounds checking in the DMo process. An attacker could exploit this vulnerability by sending crafted packets that are forwarded to the DMo process for evaluation. The impacts of a successful exploit are limited to the scope of the virtual instance and do not impact the router that is hosting Cisco IOx. This vulnerability affects the following Cisco 800 Series Industrial Integrated Services Routers: Cisco IR809 and Cisco IR829. Cisco IOx Releases 1.0.0.0 and 1.1.0.0 are vulnerable. Cisco Bug IDs: CSCuy52330.

Severity

No CVSS data available.

CWE

CWE-119 - Stack Overflow Vulnerability

Assigner

cisco mitre root

References

3 references

URL	Tags
https://tools.cisco.com/security/center/content/C…	x_refsource_CONFIRM
http://www.securitytracker.com/id/1038105	vdb-entryx_refsource_SECTRACK
http://www.securityfocus.com/bid/97011	vdb-entryx_refsource_BID

Impacted products

1 product

Vendor	Product	Version
n/a	Cisco IOx	Affected: Cisco IOx

Date Public

2017-03-22 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T14:39:41.295Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170322-iox"
          },
          {
            "name": "1038105",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1038105"
          },
          {
            "name": "97011",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/97011"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Cisco IOx",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Cisco IOx"
            }
          ]
        }
      ],
      "datePublic": "2017-03-22T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the Data-in-Motion (DMo) process installed with the Cisco IOx application environment could allow an unauthenticated, remote attacker to cause a stack overflow that could allow remote code execution with root privileges in the virtual instance running on an affected device. The vulnerability is due to insufficient bounds checking in the DMo process. An attacker could exploit this vulnerability by sending crafted packets that are forwarded to the DMo process for evaluation. The impacts of a successful exploit are limited to the scope of the virtual instance and do not impact the router that is hosting Cisco IOx. This vulnerability affects the following Cisco 800 Series Industrial Integrated Services Routers: Cisco IR809 and Cisco IR829. Cisco IOx Releases 1.0.0.0 and 1.1.0.0 are vulnerable. Cisco Bug IDs: CSCuy52330."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-119",
              "description": "CWE-119 Stack Overflow Vulnerability",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-07-11T09:57:01.000Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170322-iox"
        },
        {
          "name": "1038105",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1038105"
        },
        {
          "name": "97011",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/97011"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@cisco.com",
          "ID": "CVE-2017-3853",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Cisco IOx",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Cisco IOx"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability in the Data-in-Motion (DMo) process installed with the Cisco IOx application environment could allow an unauthenticated, remote attacker to cause a stack overflow that could allow remote code execution with root privileges in the virtual instance running on an affected device. The vulnerability is due to insufficient bounds checking in the DMo process. An attacker could exploit this vulnerability by sending crafted packets that are forwarded to the DMo process for evaluation. The impacts of a successful exploit are limited to the scope of the virtual instance and do not impact the router that is hosting Cisco IOx. This vulnerability affects the following Cisco 800 Series Industrial Integrated Services Routers: Cisco IR809 and Cisco IR829. Cisco IOx Releases 1.0.0.0 and 1.1.0.0 are vulnerable. Cisco Bug IDs: CSCuy52330."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-119 Stack Overflow Vulnerability"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170322-iox",
              "refsource": "CONFIRM",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170322-iox"
            },
            {
              "name": "1038105",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1038105"
            },
            {
              "name": "97011",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/97011"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2017-3853",
    "datePublished": "2017-03-22T19:00:00.000Z",
    "dateReserved": "2016-12-21T00:00:00.000Z",
    "dateUpdated": "2024-08-05T14:39:41.295Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CNVD-2017-04002

CVE-2017-3853 (GCVE-0-2017-3853)

Tags

Sightings

Nomenclature

Related by attack behaviour