Authenticated Command Injection Vulnerability in Multiple Cisco Content Network and Video Delivery Products

2013-07-3116:00:00

tools.cisco.com

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

EPSS

0.005

Percentile

76.3%

JSON

Multiple Cisco content network and video delivery products contain a vulnerability
when they are configured to run in central management mode. This vulnerability could allow an authenticated but unprivileged, remote attacker to
execute arbitrary code on the affected system and on the devices managed by the affected system.

Cisco has released software updates that address this vulnerability. Workarounds that mitigate this vulnerability are not available.
This advisory is available at the following link:

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130731-cm[“https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130731-cm”]

Affected configurations

Vulners

Node

ciscoapplication_and_content_networking_system_softwareMatchany

ciscowide_area_application_servicesMatchany

ciscointernet_streamer_content_delivery_systemMatchany

ciscoenterprise_content_delivery_systemMatchany

ciscovideoscape_distribution_suite_for_internet_streamingMatchany

ciscovideoscape_distribution_suite_service_brokerMatchany

ciscovideoscape_distribution_suite_optimization_engineMatchany

ciscovideoscape_distribution_suite_service_brokerMatchany

ciscoapplication_and_content_networking_system_softwareMatchany

ciscowide_area_application_servicesMatchany

ciscointernet_streamer_content_delivery_systemMatchany

ciscoenterprise_content_delivery_systemMatchany

ciscovideoscape_distribution_suite_for_internet_streamingMatchany

ciscovideoscape_distribution_suite_service_brokerMatchany

ciscovideoscape_distribution_suite_optimization_engineMatchany

ciscovideoscape_distribution_suite_service_brokerMatchany

VendorProductVersionCPE
ciscoapplication_and_content_networking_system_softwareanycpe:2.3:a:cisco:application_and_content_networking_system_software:any:*:*:*:*:*:*:*
ciscowide_area_application_servicesanycpe:2.3:a:cisco:wide_area_application_services:any:*:*:*:*:*:*:*
ciscointernet_streamer_content_delivery_systemanycpe:2.3:a:cisco:internet_streamer_content_delivery_system:any:*:*:*:*:*:*:*
ciscoenterprise_content_delivery_systemanycpe:2.3:a:cisco:enterprise_content_delivery_system:any:*:*:*:*:*:*:*
ciscovideoscape_distribution_suite_for_internet_streaminganycpe:2.3:a:cisco:videoscape_distribution_suite_for_internet_streaming:any:*:*:*:*:*:*:*
ciscovideoscape_distribution_suite_service_brokeranycpe:2.3:a:cisco:videoscape_distribution_suite_service_broker:any:*:*:*:*:*:*:*
ciscovideoscape_distribution_suite_optimization_engineanycpe:2.3:a:cisco:videoscape_distribution_suite_optimization_engine:any:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	application_and_content_networking_system_software	any	cpe:2.3:a:cisco:application_and_content_networking_system_software:any:::::::*
cisco	wide_area_application_services	any	cpe:2.3:a:cisco:wide_area_application_services:any:::::::*
cisco	internet_streamer_content_delivery_system	any	cpe:2.3:a:cisco:internet_streamer_content_delivery_system:any:::::::*
cisco	enterprise_content_delivery_system	any	cpe:2.3:a:cisco:enterprise_content_delivery_system:any:::::::*
cisco	videoscape_distribution_suite_for_internet_streaming	any	cpe:2.3:a:cisco:videoscape_distribution_suite_for_internet_streaming:any:::::::*
cisco	videoscape_distribution_suite_service_broker	any	cpe:2.3:a:cisco:videoscape_distribution_suite_service_broker:any:::::::*
cisco	videoscape_distribution_suite_optimization_engine	any	cpe:2.3:a:cisco:videoscape_distribution_suite_optimization_engine:any:::::::*