Numéro : AV17-144
Date : Le 27 Septembre 2017
Objet
Le présent avis a pour objet d'attirer l'attention sur de multiple avis de sécurité publiés par Cisco.
Évaluation
Cisco a publié des mises à jour de sécurité afin d'adresser des vulnérabilités dans les produits suivants.
-Cisco IOS XE Software Web UI REST API Authentication Bypass Vulnerability
-Cisco IOS XE Software Web UI Privilege Escalation Vulnerability
-Cisco IOS and IOS XE Software DHCP Remote Code Execution Vulnerability
-Cisco Mobility Express 1800 Access Point Series Authentication Bypass Vulnerability
-Cisco IOS Software for Cisco Catalyst 6800 Series Switches VPLS Denial of Service Vulnerability
-Cisco IOS Software for Cisco Integrated Services Routers Generation 2 Denial of Service Vulnerability
-Cisco IOS Software for Cisco Industrial Ethernet Switches PROFINET Denial of Service Vulnerability
-Cisco IOS and IOS XE Software Plug-and-Play PKI API Certificate Validation Vulnerability
-Cisco IOS XE Software for Cisco 5760 WLC, Cisco Catalyst 4500E Supervisor Engine 8-E, and Cisco NGWC 3850 GUI Privilege Escalation Vulnerability
-Cisco IOS Software Network Address Translation Denial of Service Vulnerability
-Cisco IOS XE Software Locator/ID Separation Protocol Authentication Bypass Vulnerability
-Cisco IOS XE Wireless Controller Manager Denial of Service Vulnerability
-Cisco IOS and IOS XE Software Internet Key Exchange Denial of Service Vulnerability
-Cisco IOS Software Common Industrial Protocol Request Denial of Service Vulnerabilities
-Cisco IOS XE Software for Cisco ASR 1000 Series and cBR-8 Routers Line Card Console Access Vulnerability
Références CVE : CVE-2017-3831, CVE-2017-12222, CVE-2017-12226, CVE-2017-12228, CVE-2017-12229, CVE-2017-12230, CVE-2017-12231, CVE-2017-12232, CVE-2017-12233, CVE-2017-12234, CVE-2017-12235, CVE-2017-12236, CVE-2017-12237, CVE-2017-12238, CVE-2017-12239, CVE-2017-12240
Mesures Recommandées
Le CCRIC recommande que les administrateurs de système mettent à l'essai et déploient les mises à jour diffusées par le fournisseur aux applications concernées.
Références :
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-restapi
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-privesc
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-dhcp
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-ap1800
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-vpls
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-rbip-dos
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-profinet
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-pnp
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-ngwc
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-nat
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-lisp
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-ios-xe
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-ike
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-cip
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-cc