CVE-2017-6679
CVSS6.0
发布时间 :2017-12-01 12:29:00
修订时间 :2017-12-19 14:01:51
NMPS    

[原文]The Cisco Umbrella Virtual Appliance Version 2.0.3 and prior contained an undocumented encrypted remote support tunnel (SSH) which auto initiated from the customer's appliance to Cisco's SSH Hubs in the Umbrella datacenters. These tunnels were primarily leveraged for remote support and allowed for authorized/authenticated personnel from the Cisco Umbrella team to access the appliance remotely and obtain full control without explicit customer approval. To address this vulnerability, the Umbrella Virtual Appliance version 2.1.0 now requires explicit customer approval before an SSH tunnel from the VA to the Cisco terminating server can be established.


[CNNVD]CNNVD数据暂缺。


[机译]译文暂缺.

- CVSS (基础分值)

CVSS分值: 6 [中等(MEDIUM)]
机密性影响: COMPLETE [完全的信息泄露导致所有系统文件暴露]
完整性影响: COMPLETE [系统完整性可被完全破坏]
可用性影响: COMPLETE [可能导致系统完全宕机]
攻击复杂度: HIGH [漏洞利用存在特定的访问条件]
攻击向量: LOCAL [漏洞利用需要具有物理访问权限或本地帐户]
身份认证: SINGLE_INSTANCE [--]

- CWE (弱点类目)

CWE-254 [安全特性]

- CPE (受影响的平台与产品)

产品及版本信息(CPE)暂不可用

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6679
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-6679
(官方数据源) NVD

- 其它链接及资源

http://www.securityfocus.com/bid/101567
(VENDOR_ADVISORY)  BID  101567
https://support.umbrella.com/hc/en-us/articles/115004154423
(VENDOR_ADVISORY)  MISC  https://support.umbrella.com/hc/en-us/articles/115004154423
https://support.umbrella.com/hc/en-us/articles/115004752143-Virtual-Appliance-Vulnerability-due-to-always-on-SSH-Tunnel-RESOLVED-2017-09-15
(VENDOR_ADVISORY)  MISC  https://support.umbrella.com/hc/en-us/articles/115004752143-Virtual-Appliance-Vulnerability-due-to-always-on-SSH-Tunnel-RESOLVED-2017-09-15
https://www.info-sec.ca/advisories/Cisco-Umbrella.html
(VENDOR_ADVISORY)  MISC  https://www.info-sec.ca/advisories/Cisco-Umbrella.html

- 漏洞信息 (F144723)

Cisco Umbrella Virtual Appliance 2.0.3 Undocumented Support Tunnel (PacketStormID:F144723)
2017-10-24 00:00:00
David Coomber  
advisory
cisco
CVE-2017-6679
[点击下载]

Cisco Umbrella Virtual Appliance versions 2.0.3 and below contain an undocumented, auto-initiated reverse SSH tunnel which allows the Cisco Umbrella support team to have persistent and unrestricted access to the virtual appliance.

Cisco Umbrella Virtual Appliance - Undocumented Support Tunnel (CVE-2017-6679)

Overview

"As the industryas first Secure Internet Gateway in the cloud, Cisco Umbrella provides the first line of defense against threats on the internet. Because Umbrella is delivered from the cloud, it is the easiest way to protect all of your users in minutes."

(https://umbrella.cisco.com/)

Issue

The Cisco Umbrella virtual appliance (version 2.0.3 and below) contains an undocumented, auto-initiated reverse SSH tunnel which allows the Cisco Umbrella support team to have persistent and unrestricted access to the virtual appliance.

Impact

The reverse SSH tunnel allows the Cisco Umbrella support team to have a persistent node on the network the virtual appliance is deployed on. A rogue employee or attacker able to compromise the Cisco Umbrella infrastructure could have access to all virtual appliances across the Cisco Umbrella customer base and perform a wide range of attacks.

Timeline

December 22, 2015 - Notified OpenDNS via security@opendns.com
December 22, 2015 - OpenDNS responded stating that they will investigate
January 4, 2016 - Asked for an update on their investigation
January 11, 2016 - OpenDNS said they are working through a number of options to resolve the issue
February 2, 2016 - OpenDNS advised they've shortlisted a couple of solutions and will provide another update in a week or so
February 17, 2016 - OpenDNS said they would like to schedule a call to discuss
February 24, 2016 - Had a call with OpenDNS to discuss possible solutions
April 22, 2016 - Asked for an update on the progress of the fix
May 3, 2016 - Asked for an update on the progress of the fix
July 27, 2016 - Sent the vulnerability details to the Cisco PSIRT team
July 29, 2016 - Cisco assigned a case number and asked to schedule a call to discuss
August 17, 2016 - Had a call with the Cisco PSIRT team to discuss possible solutions
September 26, 2016 - Asked for an update on the progress of the fix
October 6, 2016 - Cisco provided a status update
December 14, 2016 - Asked for an update on the progress of the fix
December 19, 2016 - Cisco provided a status update
January 10, 2017 - Asked for an update on the progress of the fix
January 10, 2017 - Cisco provided a status update
May 26, 2017 - Cisco assigned CVE-2017-6679 and advised that the issue would be made public in the next week
June 2, 2017 - Cisco asked to move the disclosure date to August 31, 2017
August 30, 2017 - Cisco released virtual appliance version 2.1.0 which resolves this vulnerability by removing the undocumented reverse SSH tunnel
September 21, 2017 - Cisco published a security advisory to document this issue

Solution

Upgrade to virtual appliance 2.1.0 or later

https://support.umbrella.com/hc/en-us/articles/115004752143-Virtual-Appliance-Vulnerability-due-to-always-on-SSH-Tunnel-RESOLVED-2017-09-15

CVE-ID: CVE-2017-6679

    

- 漏洞信息

Cisco Umbrella Virtual Appliance CVE-2017-6679 Unauthorized Access Vulnerability
Design Error 101567
Yes No
2017-10-24 12:00:00 2017-10-24 12:00:00
David Coomber.

- 受影响的程序版本

Cisco Umbrella Virtual Appliance 2.0.3
,Cisco Umbrella Virtual Appliance 2.1

- 不受影响的程序版本

Cisco Umbrella Virtual Appliance 2.1

- 漏洞讨论

Cisco Umbrella Virtual Appliance is prone to a unauthorized access vulnerability.

An attacker can exploit this issue to bypass the security mechanism and gain unauthorized access. This may lead to further attacks.

- 漏洞利用

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: vuldb@securityfocus.com.

- 解决方案

Updates are available. Please see the references or vendor advisory for more information.

- 相关参考

 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站