Numéro : AV18-143
Date : Le 29 août 2018
Objet
L'objectif de cet avis est d'attirer l'attention sur des avis de sécurité publié par Cisco.
Évaluation
Cisco a publié plusieurs mises à jour de sécurité pour corriger des vulnérabilités dans plusieurs produits.
Produits visés:
- Cisco Identity Services Engine (ISE)
- Cisco Unified Intelligence Center
- Cisco Emergency Responder
- Cisco Hosted Collaboration Solution for Contact Center
- Cisco Unified Communications Manager IM & Presence Service (formerly CUPS)
- Cisco Unified Communications Manager
- Cisco Unified Contact Center Enterprise
- Cisco Unified Intelligent Contact Management Enterprise
- Cisco Unified SIP Proxy Software
- Cisco Unified Survivable Remote Site Telephony Manager
- Cisco Unity Connection
- Cisco Video Distribution Suite for Internet Streaming (VDS-IS)
- Cisco Network Performance Analysis
- Cisco Data Center Network Manager (DCNM) software releases prior to 11.0(1)
- Cisco Tetration Analytics
- Cisco Firepower Threat Defense (FTD) Software
- Cisco Identity Services Engine (ISE)
- Cisco Prime Collaboration Assurance
- Cisco Prime Collaboration Deployment
- Cisco Prime Collaboration Provisioning
- Cisco Prime Infrastructure
- Cisco IOS XE Software
- Cisco Network Assurance Engine
- Cisco Nexus 3000 Series Switches
- Cisco Nexus 9000 Series Switches - Standalone, NX-OS mode
- Cisco UCS Standalone C-Series Rack Server - Integrated Management Controller
- Cisco Emergency Responder
- Cisco IP Phone 7800 Series
- Cisco Paging Server
- Cisco Unity Connection
- Cisco TelePresence Conductor
- Cisco Video Surveillance 8000 Series IP Cameras
- Cisco Aironet 1560 Series Access Points
- Cisco Aironet 1815 Series Access Points
- Cisco Aironet 2800 Series Access Points
- Cisco Aironet 3800 Series Access Points
- Cisco 4000 Series Integrated Services Routers (IOS XE Open Service Containers)
- Cisco ASR 1000 Series Aggregation Services Router with RP2 or RP3 (IOS XE Open Service Containers)
- Cisco ASR 1001-HX Series Aggregation Services Routers (IOS XE Open Service Containers)
- Cisco ASR 1001-X Series Aggregation Services Routers (IOS XE Open Service Containers)
- Cisco ASR 1002-HX Series Aggregation Services Routers (IOS XE Open Service Containers)
- Cisco ASR 1002-X Series Aggregation Services Routers (IOS XE Open Service Containers)
- Cisco Cloud Services Router 1000V Series (IOS XE Open Service Containers)
- Cisco Nexus 3000 Series Switches
- Cisco Nexus 3500 Series Switches
- Cisco Nexus 5000 Series Switches
- Cisco Nexus 7000 Series Switches
- Cisco Nexus 9000 Series Switches - Standalone, NX-OS mode
- Cisco C880 M4 Server
- Cisco C880 M5 Server
- Cisco Enterprise NFV Infrastructure Software (NFVIS)
- Cisco UCS B-Series M2 Blade Servers
- Cisco UCS B-Series M3 Blade Servers - Managed
- Cisco UCS B-Series M4 Blade Servers (except B260, B460)
- Cisco UCS B-Series M5 Blade Servers
- Cisco UCS C-Series M2 Rack Servers
- Cisco UCS C-Series M3 Rack Servers - Managed
- Cisco UCS C-Series M3 Rack Servers - Standalone
- Cisco UCS C-Series M4 Rack Servers (except C460) - Standalone 1
- Cisco UCS C-Series M4 Rack Servers (except C460) -Managed 1
- Cisco UCS C-Series M5 Rack Servers - Managed 1
- Cisco UCS C-Series M5 Rack Servers -Standalone 1
- Cisco UCS E-Series Servers
- Cisco UCS S3260 M4 Storage Server
- Cisco Remote Expert Mobile
- Cisco Video Surveillance Media Server
- Cisco Metacloud
Références CVE:
CVE-2018-0464, CVE-2018-3615, CVE-2018-3620, CVE-2018-3646, CVE-2018-5391, CVE-2018-11776
Mesure suggérée
Le CCRIC recommande que les administrateurs de système mettent à l'essai et déploient les mises à jour diffusées par le fournisseur aux applications concernées.
Références
https://tools.cisco.com/security/center/publicationListing.x
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180823-apache-struts
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180828-dcnm-traversal
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180824-linux-ip-fragment
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180814-cpusidechannel