Vulnerability-Lookup

CNVD-2018-22757

Vulnerability from cnvd - Published: 2018-11-08

Title

Cisco Unity Express任意命令执行漏洞

Description

Cisco Unity是面向企业级机构的高级统一通信解决方案可以提供强大的消息发送服务和智能化的语音消息发送服务。 Cisco Unity Express存在任意命令执行漏洞，该漏洞是由于受影响的软件对用户提供的内容进行了不安全的反序列化。攻击者可以通过将恶意序列化Java对象发送到侦听Java远程方法调用（RMI）服务来利用此漏洞。成功利用可能允许攻击者使用root权限在设备上执行任意命令。

Severity

高

Patch Name

Cisco Unity Express任意命令执行漏洞的补丁

Patch Description

Formal description

思科发布了解决此漏洞的软件更新： https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-cue

Reference

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-cue

Impacted products

Name
Cisco Unity Express <9.0.6

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-15381"
    }
  },
  "description": "Cisco Unity\u662f\u9762\u5411\u4f01\u4e1a\u7ea7\u673a\u6784\u7684\u9ad8\u7ea7\u7edf\u4e00\u901a\u4fe1\u89e3\u51b3\u65b9\u6848\u53ef\u4ee5\u63d0\u4f9b\u5f3a\u5927\u7684\u6d88\u606f\u53d1\u9001\u670d\u52a1\u548c\u667a\u80fd\u5316\u7684\u8bed\u97f3\u6d88\u606f\u53d1\u9001\u670d\u52a1\u3002\n\nCisco Unity Express\u5b58\u5728\u4efb\u610f\u547d\u4ee4\u6267\u884c\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u662f\u7531\u4e8e\u53d7\u5f71\u54cd\u7684\u8f6f\u4ef6\u5bf9\u7528\u6237\u63d0\u4f9b\u7684\u5185\u5bb9\u8fdb\u884c\u4e86\u4e0d\u5b89\u5168\u7684\u53cd\u5e8f\u5217\u5316\u3002\u653b\u51fb\u8005\u53ef\u4ee5\u901a\u8fc7\u5c06\u6076\u610f\u5e8f\u5217\u5316Java\u5bf9\u8c61\u53d1\u9001\u5230\u4fa6\u542cJava\u8fdc\u7a0b\u65b9\u6cd5\u8c03\u7528\uff08RMI\uff09\u670d\u52a1\u6765\u5229\u7528\u6b64\u6f0f\u6d1e\u3002 \u6210\u529f\u5229\u7528\u53ef\u80fd\u5141\u8bb8\u653b\u51fb\u8005\u4f7f\u7528root\u6743\u9650\u5728\u8bbe\u5907\u4e0a\u6267\u884c\u4efb\u610f\u547d\u4ee4\u3002",
  "discovererName": "Joshua Graham of TSS",
  "formalWay": "\u601d\u79d1\u53d1\u5e03\u4e86\u89e3\u51b3\u6b64\u6f0f\u6d1e\u7684\u8f6f\u4ef6\u66f4\u65b0\uff1a\r\nhttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-cue",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-22757",
  "openTime": "2018-11-08",
  "patchDescription": "Cisco Unity\u662f\u9762\u5411\u4f01\u4e1a\u7ea7\u673a\u6784\u7684\u9ad8\u7ea7\u7edf\u4e00\u901a\u4fe1\u89e3\u51b3\u65b9\u6848\u53ef\u4ee5\u63d0\u4f9b\u5f3a\u5927\u7684\u6d88\u606f\u53d1\u9001\u670d\u52a1\u548c\u667a\u80fd\u5316\u7684\u8bed\u97f3\u6d88\u606f\u53d1\u9001\u670d\u52a1\u3002\r\n\r\nCisco Unity Express\u5b58\u5728\u4efb\u610f\u547d\u4ee4\u6267\u884c\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u662f\u7531\u4e8e\u53d7\u5f71\u54cd\u7684\u8f6f\u4ef6\u5bf9\u7528\u6237\u63d0\u4f9b\u7684\u5185\u5bb9\u8fdb\u884c\u4e86\u4e0d\u5b89\u5168\u7684\u53cd\u5e8f\u5217\u5316\u3002\u653b\u51fb\u8005\u53ef\u4ee5\u901a\u8fc7\u5c06\u6076\u610f\u5e8f\u5217\u5316Java\u5bf9\u8c61\u53d1\u9001\u5230\u4fa6\u542cJava\u8fdc\u7a0b\u65b9\u6cd5\u8c03\u7528\uff08RMI\uff09\u670d\u52a1\u6765\u5229\u7528\u6b64\u6f0f\u6d1e\u3002 \u6210\u529f\u5229\u7528\u53ef\u80fd\u5141\u8bb8\u653b\u51fb\u8005\u4f7f\u7528root\u6743\u9650\u5728\u8bbe\u5907\u4e0a\u6267\u884c\u4efb\u610f\u547d\u4ee4\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Cisco Unity Express\u4efb\u610f\u547d\u4ee4\u6267\u884c\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Cisco Unity Express \u003c9.0.6"
  },
  "referenceLink": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-cue",
  "serverity": "\u9ad8",
  "submitTime": "2018-11-08",
  "title": "Cisco Unity Express\u4efb\u610f\u547d\u4ee4\u6267\u884c\u6f0f\u6d1e"
}

CVE-2018-15381 (GCVE-0-2018-15381)

Vulnerability from cvelistv5 – Published: 2018-11-08 17:00 – Updated: 2024-11-26 14:22

Title

Cisco Unity Express Arbitrary Command Execution Vulnerability

Summary

A Java deserialization vulnerability in Cisco Unity Express (CUE) could allow an unauthenticated, remote attacker to execute arbitrary shell commands with the privileges of the root user. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An attacker could exploit this vulnerability by sending a malicious serialized Java object to the listening Java Remote Method Invocation (RMI) service. A successful exploit could allow the attacker to execute arbitrary commands on the device with root privileges.

Severity

9.8 (Critical)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-11-25 18:54 UTC

CWE

CWE-502

Assigner

cisco CNA under the mitre root

CNA scorecard C 66/100 over 431 records in the last 180 days details

References

3 references

URL	Tags
http://www.securitytracker.com/id/1042130	vdb-entryx_refsource_SECTRACK
https://tools.cisco.com/security/center/content/C…	vendor-advisoryx_refsource_CISCO
http://www.securityfocus.com/bid/105876	vdb-entryx_refsource_BID

Impacted products

1 product

Vendor	Product	Version
Cisco	Cisco Unity Express	Affected: n/a

Date Public

2018-11-07 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T09:54:02.911Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "1042130",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1042130"
          },
          {
            "name": "20181107 Cisco Unity Express Arbitrary Command Execution Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-cue"
          },
          {
            "name": "105876",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/105876"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2018-15381",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-25T18:54:44.583876Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-26T14:22:53.464Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Cisco Unity Express",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-11-07T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A Java deserialization vulnerability in Cisco Unity Express (CUE) could allow an unauthenticated, remote attacker to execute arbitrary shell commands with the privileges of the root user. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An attacker could exploit this vulnerability by sending a malicious serialized Java object to the listening Java Remote Method Invocation (RMI) service. A successful exploit could allow the attacker to execute arbitrary commands on the device with root privileges."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-11-16T10:57:01.000Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "1042130",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1042130"
        },
        {
          "name": "20181107 Cisco Unity Express Arbitrary Command Execution Vulnerability",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-cue"
        },
        {
          "name": "105876",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/105876"
        }
      ],
      "source": {
        "advisory": "cisco-sa-20181107-cue",
        "defect": [
          [
            "CSCvm02856"
          ]
        ],
        "discovery": "INTERNAL"
      },
      "title": "Cisco Unity Express Arbitrary Command Execution Vulnerability",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@cisco.com",
          "DATE_PUBLIC": "2018-11-07T16:00:00-0600",
          "ID": "CVE-2018-15381",
          "STATE": "PUBLIC",
          "TITLE": "Cisco Unity Express Arbitrary Command Execution Vulnerability"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Cisco Unity Express",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Cisco"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A Java deserialization vulnerability in Cisco Unity Express (CUE) could allow an unauthenticated, remote attacker to execute arbitrary shell commands with the privileges of the root user. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An attacker could exploit this vulnerability by sending a malicious serialized Java object to the listening Java Remote Method Invocation (RMI) service. A successful exploit could allow the attacker to execute arbitrary commands on the device with root privileges."
            }
          ]
        },
        "exploit": [
          {
            "lang": "en",
            "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
          }
        ],
        "impact": {
          "cvss": {
            "baseScore": "9.8",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-502"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "1042130",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1042130"
            },
            {
              "name": "20181107 Cisco Unity Express Arbitrary Command Execution Vulnerability",
              "refsource": "CISCO",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-cue"
            },
            {
              "name": "105876",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/105876"
            }
          ]
        },
        "source": {
          "advisory": "cisco-sa-20181107-cue",
          "defect": [
            [
              "CSCvm02856"
            ]
          ],
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2018-15381",
    "datePublished": "2018-11-08T17:00:00.000Z",
    "dateReserved": "2018-08-17T00:00:00.000Z",
    "dateUpdated": "2024-11-26T14:22:53.464Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted