Vulnerability CVE-2015-0713 - CERT Civis.Net

Vulnerability Name:

CVE-2015-0713 (CCN-103144)

Assigned:

2015-05-13

Published:

2015-05-13

Updated:

2015-05-26

Summary:

The web framework in Cisco TelePresence Advanced Media Gateway Series Software before 1.1(1.40), Cisco TelePresence IP Gateway Series Software, Cisco TelePresence IP VCR Series Software before 3.0(1.27), Cisco TelePresence ISDN Gateway Software before 2.2(1.94), Cisco TelePresence MCU Software before 4.4(3.54) and 4.5 before 4.5(1.45), Cisco TelePresence MSE Supervisor Software before 2.3(1.38), Cisco TelePresence Serial Gateway Series Software before 1.0(1.42), Cisco TelePresence Server Software for Hardware before 3.1(1.98), and Cisco TelePresence Server Software for Virtual Machine before 4.1(1.79) allows remote authenticated users to execute arbitrary commands with root privileges via unspecified vectors, aka Bug IDs CSCul55968, CSCur08993, CSCur15803, CSCur15807, CSCur15825, CSCur15832, CSCur15842, CSCur15850, and CSCur15855.

CVSS v3 Severity:

9.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): Required
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

9.0 High (CVSS v2 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C)
6.7 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

9.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C)
6.7 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2015-0713

Source: CCN
Type: Cisco Security Advisory ID: cisco-sa-20150513-tp
Command Injection Vulnerability in Multiple Cisco TelePresence Products

Source: CISCO
Type: Vendor Advisory
20150513 Command Injection Vulnerability in Multiple Cisco TelePresence Products

Source: CCN
Type: BID-74638
Multiple Cisco TelePresence Products CVE-2015-0713 Remote Command Injection Vulnerability

Source: XF
Type: UNKNOWN
cisco-telepresence-cve20150713-command-exec(103144)

Vulnerable Configuration:

Configuration 1:

cpe:/a:cisco:telepresence_advanced_media_gateway:1.0(.1.13):*:*:*:*:*:*:*

OR cpe:/a:cisco:telepresence_advanced_media_gateway:1.1(.1.14):*:*:*:*:*:*:*

OR cpe:/a:cisco:telepresence_advanced_media_gateway:1.1(1.34):*:*:*:*:*:*:*

OR cpe:/a:cisco:telepresence_ip_gateway:2.0.1.7:*:*:*:*:*:*:*

OR cpe:/a:cisco:telepresence_ip_gateway:2.0.1.11:*:*:*:*:*:*:*

OR cpe:/a:cisco:telepresence_ip_gateway:2.0.3.34:*:*:*:*:*:*:*

OR cpe:/a:cisco:telepresence_ip_vcr_1.0_converter:1.0(1.9):*:*:*:*:*:*:*

OR cpe:/a:cisco:telepresence_ip_vcr_2.4:1.2:*:*:*:*:*:*:*

OR cpe:/a:cisco:telepresence_ip_vcr_3.0:1.22:*:*:*:*:*:*:*

OR cpe:/a:cisco:telepresence_ip_vcr_3.0:1.24:*:*:*:*:*:*:*

OR cpe:/a:cisco:telepresence_isdn_gw_3241:2.0(1.51):*:*:*:*:*:*:*

OR cpe:/a:cisco:telepresence_isdn_gw_3241:2.1(1.22):*:*:*:*:*:*:*

OR cpe:/a:cisco:telepresence_isdn_gw_3241:2.1(1.43):*:*:*:*:*:*:*

OR cpe:/a:cisco:telepresence_isdn_gw_3241:2.1(1.49):*:*:*:*:*:*:*

OR cpe:/a:cisco:telepresence_isdn_gw_3241:2.1(1.56):*:*:*:*:*:*:*

OR cpe:/a:cisco:telepresence_mcu_software:4.1(1.51):*:*:*:*:*:*:*

OR cpe:/a:cisco:telepresence_mcu_software:4.1(1.59):*:*:*:*:*:*:*

OR cpe:/a:cisco:telepresence_mcu_software:4.2(1.43):*:*:*:*:*:*:*

OR cpe:/a:cisco:telepresence_mcu_software:4.2(1.46):*:*:*:*:*:*:*

OR cpe:/a:cisco:telepresence_mcu_software:4.2(1.50):*:*:*:*:*:*:*

OR cpe:/a:cisco:telepresence_mcu_software:4.3(1.68):*:*:*:*:*:*:*

OR cpe:/a:cisco:telepresence_mcu_software:4.3(2.18):*:*:*:*:*:*:*

OR cpe:/a:cisco:telepresence_mcu_software:4.3(2.30):*:*:*:*:*:*:*

OR cpe:/a:cisco:telepresence_mcu_software:4.3(2.32):*:*:*:*:*:*:*

OR cpe:/a:cisco:telepresence_mcu_software:4.4(3.42):*:*:*:*:*:*:*

OR cpe:/a:cisco:telepresence_mcu_software:4.4(3.49):*:*:*:*:*:*:*

OR cpe:/a:cisco:telepresence_serial_gateway:1.0.1.23:*:*:*:*:*:*:*

OR cpe:/a:cisco:telepresence_serial_gateway:1.0.1.34:*:*:*:*:*:*:*

OR cpe:/a:cisco:telepresence_serial_gateway:1.0.1.38:*:*:*:*:*:*:*

OR cpe:/a:cisco:telepresence_server_software:2.1(1.33):*:*:*:*:*:*:*

OR cpe:/a:cisco:telepresence_server_software:2.1(1.37):*:*:*:*:*:*:*

OR cpe:/a:cisco:telepresence_server_software:2.2(1.43):*:*:*:*:*:*:*

OR cpe:/a:cisco:telepresence_server_software:2.2(1.48):*:*:*:*:*:*:*

OR cpe:/a:cisco:telepresence_server_software:2.2(1.54):*:*:*:*:*:*:*

OR cpe:/a:cisco:telepresence_server_software:2.3(1.55):*:*:*:*:*:*:*

OR cpe:/a:cisco:telepresence_server_software:2.3(1.57):*:*:*:*:*:*:*

OR cpe:/a:cisco:telepresence_server_software:3.0(2.24):*:*:*:*:*:*:*

OR cpe:/a:cisco:telepresence_server_software:4.0(1.57):*:*:*:*:*:*:*

OR cpe:/a:cisco:telepresence_server_software:4.0(2.8):*:*:*:*:*:*:*

OR cpe:/a:cisco:telepresence_supervisor_mse_8050_software:2.1(1.18):*:*:*:*:*:*:*

OR cpe:/a:cisco:telepresence_supervisor_mse_8050_software:2.2(1.17):*:*:*:*:*:*:*

OR cpe:/a:cisco:telepresence_supervisor_mse_8050_software:2.3(1.32):*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:cisco:telepresence_mcu_4500_series_software:4.1(1.51):*:*:*:*:*:*:*

Denotes that component is vulnerable