Note to readers

This publication does not currently meet the Government of Canada's Web Standards. The information remains valid.

Cisco Releases security updates

Number: AV17-042
Date: 6 April 2017

Purpose

The purpose of this advisory is to bring attention to multiple Cisco security advisories.

Assessment

Cisco released multiple security updates to address vulnerabilities in the following products.

  • Cisco Aironet 1800, 2800, and 3800 Series Access Point Platforms Shell Bypass Vulnerability
  • Cisco Aironet 1830 Series and 1850 Series Access Points Mobility Express Default Credential Vulnerability
  • Cisco ASR 903 and ASR 920 Series Devices IPv6 Packet Processing Denial of Service Vulnerability
  • Cisco Firepower Detection Engine SSL Denial of Service Vulnerability
  • Cisco IOS XE Software Startup Script Local Command Execution Vulnerability
  • Cisco IOS XR Software Denial of Service Vulnerability
  • Cisco Integrated Management Controller Redirection Vulnerability
  • Cisco Mobility Express 2800 and 3800 Series Wireless LAN Controllers Shell Bypass Vulnerability
  • Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager Web Interface Information Disclosure Vulnerability
  • Cisco Registered Envelope Service Open Redirect Vulnerability
  • Cisco UCS Director Virtual Machine Information Disclosure Vulnerability
  • Cisco UCS Manager, Cisco Firepower 4100 Series NGFW, and Cisco Firepower 9300 Security Appliance CLI Command Injection Vulnerability
  • Cisco UCS Manager, Cisco Firepower 4100 Series NGFW, and Cisco Firepower 9300 Security Appliance Debug Plug-in Privilege Escalation Vulnerability
  • Cisco UCS Manager, Cisco Firepower 4100 Series NGFW, and Cisco Firepower 9300 Security Appliance local-mgmt CLI Command Injection Vulnerability
  • Cisco Unified Communications Manager Cross-Site Scripting Vulnerability
  • Cisco Unified Communications Manager SQL Injection Vulnerability
  • Cisco Wireless LAN Controller IPv6 UDP Denial of Service Vulnerability
  • Cisco Wireless LAN Controller Management GUI Denial of Service Vulnerability
  • Cisco Wireless LAN Controller RADIUS Change of Authorization Denial of Service Vulnerability
  • Cisco Wireless LAN Controller 802.11 WME Denial of Service Vulnerability

CVE References:

Critical: CVE-2017-3834

High: CVE-2016-9194, CVE-2016-9219, CVE-2017-3832

Medium:
CVE-2016-9195, CVE-2016-9196, CVE-2016-9197, CVE-2017-3817, CVE-2017-3884, CVE-2017-3885,
CVE-2017-3886, CVE-2017-3887, CVE-2017-3888, CVE-2017-3889, CVE-2017-6597, CVE-2017-6598,
CVE-2017-6599, CVE-2017-6600, CVE-2017-6601, CVE-2017-6602, CVE-2017-6603, CVE-2017-6604,
CVE-2017-6606  

Suggested Action

CCIRC recommends that system administrators test and deploy the vendor-released updates to affected applications accordingly.

References:

Date modified: