Cisco Releases security updates

Number: AV17-034
Date: 16 March 2017

Purpose

The purpose of this advisory is to bring attention to multiple Cisco security advisories.

Assessment

Cisco released multiple security updates to address vulnerabilities (critical to medium) in the following products.

Apache Struts2 Jakarta Multipart Parser File Upload Code Execution Vulnerability Affecting Cisco Products
Cisco Web Security Appliance URL Filtering Bypass Vulnerability
Cisco WebEx Meetings Server XML External Entity Vulnerability
Cisco Meshed Wireless LAN Controller Impersonation Vulnerability
Cisco WebEx Meetings Server Authentication Bypass Vulnerability
Cisco UCS Director Cross-Site Scripting Vulnerability
Cisco Unified Communications Manager Cross-Site Request Forgery Vulnerability
Cisco Unified Communications Manager Cross-Site Scripting Vulnerability
Cisco Unified Communications Manager Web Interface Cross-Site Scripting Vulnerability
Cisco TelePresence Server API Privilege Vulnerability
Cisco Workload Automation and Tidal Enterprise Scheduler Client Manager Server Arbitrary File Read Vulnerability
Cisco Prime Service Catalog Multiple Cross-Site Scripting Vulnerabilities
Cisco Nexus 9000 Series Switches Remote Login Denial of Service Vulnerability
Cisco Nexus 9000 Series Switches Telnet Login Denial of Service Vulnerability
Cisco Prime Optical for Service Providers RADIUS Secret Disclosure Vulnerability
Cisco Prime Infrastructure API Credentials Management Vulnerability
Cisco Nexus 7000 Series Switches Access-Control Filtering Mechanisms Bypass Vulnerability
Cisco StarOS SSH Privilege Escalation Vulnerability
Cisco Adaptive Security Appliance BGP Bidirectional Forwarding Detection ACL Bypass Vulnerability
Cisco Mobility Express 1800 Access Point Series Authentication Bypass Vulnerability

CVE References:
Critical: CVE-2017-3831, CVE-2017-5638
High: CVE-2017-3846, CVE-2017-3854
Medium: CVE-2017-3811, CVE-2017-3815, CVE-2017-3819, CVE-2017-3866, CVE-2017-3867, CVE-2017-3868, CVE-2017-3869, CVE-2017-3870, CVE-2017-3871, CVE-2017-3872, CVE-2017-3874, CVE-2017-3875, CVE-2017-3877, CVE-2017-3878, CVE-2017-3879, CVE-2017-3880

Suggested action

CCIRC recommends that system administrators test and deploy the vendor-released updates to affected applications accordingly.

References

Language selection

Search

Purpose

Assessment

Suggested action

References

Note to readers

Cisco Releases security updates

Purpose

Assessment

Suggested action

References