Note to readers

This publication does not currently meet the Government of Canada's Web Standards. The information remains valid.

Cisco security updates

Number: AV18-089
Date: 6 June 2018

Purpose

The purpose of this advisory is to bring attention to multiple Cisco security advisories.

Assessment

Cisco released multiple security updates to address vulnerabilities (medium to critical) in various Cisco products.

Affected Products:

  • Cisco Prime Collaboration Provisioning Unauthenticated Remote Method Invocation Vulnerability
  • Cisco IOS XE Software Authentication, Authorization, and Accounting Login Authentication Remote Code Execution Vulnerability
  • Cisco Web Security Appliance Layer 4 Traffic Monitor Security Bypass Vulnerability
  • Cisco Prime Collaboration Provisioning SQL Injection Vulnerability
  • Cisco Prime Collaboration Provisioning Unauthorized Password Reset Vulnerability
  • Cisco Prime Collaboration Provisioning Unauthorized Password Recovery Vulnerability
  • Cisco Prime Collaboration Provisioning Access Control Bypass Vulnerability
  • Cisco Prime Collaboration Provisioning Access Control Vulnerability
  • Cisco Network Services Orchestrator Arbitrary Command Execution Vulnerability
  • Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware Session Initiation Protocol Denial of Service Vulnerability
  • Cisco Products Disk Utilization Denial of Service Vulnerability
  • Cisco Meeting Server Information Disclosure Vulnerability
  • Cisco Adaptive Security Appliance Web Services Denial of Service Vulnerability
  • Cisco WebEx Cross-Site Scripting Vulnerability
  • Cisco Wide Area Application Services Software Static SNMP Credentials Vulnerability
  • Cisco Wide Area Application Services Software Disk Check Tool Privilege Escalation Vulnerability
  • Cisco Integrated Management Controller Supervisor and Cisco UCS Director DOM Stored Cross-Site Scripting Vulnerability
  • Cisco Unified Computing System Role-Based Access Vulnerability
  • Cisco Unified Communications Manager Cross-Site Scripting Vulnerability
  • Cisco Prime Collaboration Provisioning Access Control Deficiency in Batch Function Privilege Escalation Vulnerability
  • Cisco Identity Services Engine Cross-Site Scripting Vulnerability
  • Cisco Unified IP Phone Software Denial of Service Vulnerability
  • Cisco Unified Communications Manager Cross-Frame Scripting Vulnerability
  • Cisco Unity Connection Cross-Site Scripting Vulnerability
  • Cisco Prime Collaboration Provisioning Cleartext Passwords Written to World-Readable File Vulnerability
  • Cisco FireSIGHT System VPN Policy Bypass Vulnerability
  • Cisco AnyConnect Secure Mobility Client Certificate Bypass Vulnerability

CVE References: CVE-2018-0149,CVE-2018-0263,CVE-2018-0274,CVE-2018-0296,CVE-2018-0315,CVE-2018-0316,CVE-2018-0317,CVE-2018-0318,CVE-2018-0319,CVE-2018-0320,CVE-2018-0321,CVE-2018-0322,CVE-2018-0329,CVE-2018-0332,CVE-2018-0333,CVE-2018-0334,CVE-2018-0335,CVE-2018-0336,CVE-2018-0338,CVE-2018-0339,CVE-2018-0340,CVE-2018-0352,CVE-2018-0353,CVE-2018-0354,CVE-2018-0355,CVE-2018-0356,CVE-2018-0357

Suggested Action

CCIRC recommends that system administrators test and deploy the vendor-released updates to affected applications accordingly.

References:

Date modified: