CVE-2016-6450

A vulnerability in the package unbundle utility of Cisco IOS XE Software could allow an authenticated, local attacker to gain write access to some files in the underlying operating system. This vulnerability affects the following products if they are running a vulnerable release of Cisco IOS XE Software: Cisco 5700 Series Wireless LAN Controllers, Cisco Catalyst 3650 Series Switches, Cisco Catalyst 3850 Series Switches, Cisco Catalyst 4500E Series Switches, Cisco Catalyst 4500X Series Switches. More Information: CSCva60013 CSCvb22622. Known Affected Releases: 3.7(0) 16.4.1 Denali-16.1.3 Denali-16.2.2 Denali-16.3.1. Known Fixed Releases: 15.2(4)E3 16.1(2.208) 16.2(2.42) 16.3(1.22) 16.4(0.190) 16.5(0.29).

CVSS v3 2.5 LOW
CVSS v2.0 1.9 LOW

2.5^/10

CVSS v3 : LOW

Vector : AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Exploitability : 1.0 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

1.9^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 3.4 / Impact : 2.9

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/bid/94340
http://www.securitytracker.com/id/1037299
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161115-iosxe	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:cisco:ios_xe:3.6.2ae:::::::*
	cpe:2.3:o:cisco:ios_xe:3.6.3e:::::::*
	cpe:2.3:o:cisco:ios_xe:3.6.4e:::::::*
	cpe:2.3:o:cisco:ios_xe:3.8.1e:::::::*
	cpe:2.3:o:cisco:ios_xe:16.1.1:::::::*
	cpe:2.3:o:cisco:ios_xe:16.1.2:::::::*
	cpe:2.3:o:cisco:ios_xe:16.1.3:::::::*
	cpe:2.3:o:cisco:ios_xe:16.2.1:::::::*
	cpe:2.3:o:cisco:ios_xe:16.2.2:::::::*
	cpe:2.3:o:cisco:ios_xe:16.3.1:::::::*

History

No history.

Information

Published : 2016-11-19 03:02

Updated : 2024-02-04 19:11

NVD link : CVE-2016-6450

Mitre link : CVE-2016-6450

CVE.ORG link : CVE-2016-6450

JSON object : View

Products Affected

cisco

ios_xe

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2016-6450", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 1.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 2.5, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.0}]}, "published": "2016-11-19T03:02:59.117", "references": [{"url": "http://www.securityfocus.com/bid/94340", "source": "ykramarz@cisco.com"}, {"url": "http://www.securitytracker.com/id/1037299", "source": "ykramarz@cisco.com"}, {"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161115-iosxe", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the package unbundle utility of Cisco IOS XE Software could allow an authenticated, local attacker to gain write access to some files in the underlying operating system. This vulnerability affects the following products if they are running a vulnerable release of Cisco IOS XE Software: Cisco 5700 Series Wireless LAN Controllers, Cisco Catalyst 3650 Series Switches, Cisco Catalyst 3850 Series Switches, Cisco Catalyst 4500E Series Switches, Cisco Catalyst 4500X Series Switches. More Information: CSCva60013 CSCvb22622. Known Affected Releases: 3.7(0) 16.4.1 Denali-16.1.3 Denali-16.2.2 Denali-16.3.1. Known Fixed Releases: 15.2(4)E3 16.1(2.208) 16.2(2.42) 16.3(1.22) 16.4(0.190) 16.5(0.29)."}, {"lang": "es", "value": "Una vulnerabilidad en la utilidad de desagrupar paquetes del Software Cisco IOS XE podr\u00edan permitir a un atacante local autenticado obtener acceso de escritura a algunos archivos del sistema operativo subyaciente. Esta vulnerabilidad afecta a los siguientes productos si est\u00e1n ejecutando una versi\u00f3n vulnerable del Software Cisco IOS XE: Cisco 5700 Series Wireless LAN Controllers, Cisco Catalyst 3650 Series Switches, Cisco Catalyst 3850 Series Switches, Cisco Catalyst 4500E Series Switches, Cisco Catalyst 4500X Series Switches. M\u00e1s informaci\u00f3n: CSCva60013 CSCvb22622. Lanzamientos afectados conocidos: 3.7(0) 16.4.1 Denali-16.1.3 Denali-16.2.2 Denali-16.3.1. Lanzamientos conocidos solucionados: 15.2(4)E3 16.1(2.208) 16.2(2.42) 16.3(1.22) 16.4(0.190) 16.5(0.29)."}], "lastModified": "2017-07-28T01:29:02.173", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cisco:ios_xe:3.6.2ae:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "39DED4C1-E7AF-48E0-8B1A-839A87E52992"}, {"criteria": "cpe:2.3:o:cisco:ios_xe:3.6.3e:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E77A9A46-517E-467B-A702-E6F6DD9FCD96"}, {"criteria": "cpe:2.3:o:cisco:ios_xe:3.6.4e:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AD485792-290B-4553-AAB2-DA7427DE7131"}, {"criteria": "cpe:2.3:o:cisco:ios_xe:3.8.1e:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6907E1FE-760E-4557-A472-1A1F0052B82B"}, {"criteria": "cpe:2.3:o:cisco:ios_xe:16.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0ED5527C-A638-4E20-9928-099E32E17743"}, {"criteria": "cpe:2.3:o:cisco:ios_xe:16.1.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1A685A9A-235D-4D74-9D6C-AC49E75709CA"}, {"criteria": "cpe:2.3:o:cisco:ios_xe:16.1.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "43052998-0A27-4E83-A884-A94701A3F4CE"}, {"criteria": "cpe:2.3:o:cisco:ios_xe:16.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "89526731-B712-43D3-B451-D7FC503D2D65"}, {"criteria": "cpe:2.3:o:cisco:ios_xe:16.2.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "302933FE-4B6A-48A3-97F0-4B943251B717"}, {"criteria": "cpe:2.3:o:cisco:ios_xe:16.3.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "296636F1-9242-429B-8472-90352C056106"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}