Lucene search

[email protected]CVE-2016-1404

HistoryMay 29, 2016 - 10:59 p.m.

CVE-2016-1404

2016-05-2922:59:00

CWE-200

[email protected]

web.nvd.nist.gov

cisco

ucs

invicta

4.3

4.5

5.0.1

gnupg

encryption key

vulnerability

remote attackers

cryptographic protection mechanisms

network traffic

autosupport server

bug id

cscur85504

cve-2016-1404

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

0.002 Low

EPSS

Percentile

55.1%

JSON

Cisco UCS Invicta 4.3, 4.5, and 5.0.1 on Invicta appliances and Invicta Scaling System uses the same hardcoded GnuPG encryption key across different customers’ installations, which allows remote attackers to defeat cryptographic protection mechanisms by sniffing network traffic to an Autosupport server and leveraging knowledge of this key from another installation, aka Bug ID CSCur85504.

Affected configurations

NVD

Node

ciscoucs_invicta_c3124sa_applianceMatch4.3.1

ciscoucs_invicta_c3124sa_applianceMatch4.3_base

ciscoucs_invicta_c3124sa_applianceMatch4.5.0

ciscoucs_invicta_c3124sa_applianceMatch4.5_base

ciscoucs_invicta_c3124sa_applianceMatch5.0.1

ciscoucs_invicta_c3124sa_applianceMatch5.0_base

CPENameOperatorVersion
cisco:ucs_invicta_c3124sa_appliancecisco ucs invicta c3124sa applianceeq4.3.1
cisco:ucs_invicta_c3124sa_appliancecisco ucs invicta c3124sa applianceeq4.3_base
cisco:ucs_invicta_c3124sa_appliancecisco ucs invicta c3124sa applianceeq4.5.0
cisco:ucs_invicta_c3124sa_appliancecisco ucs invicta c3124sa applianceeq4.5_base
cisco:ucs_invicta_c3124sa_appliancecisco ucs invicta c3124sa applianceeq5.0.1
cisco:ucs_invicta_c3124sa_appliancecisco ucs invicta c3124sa applianceeq5.0_base

CPE	Name	Operator	Version
cisco:ucs_invicta_c3124sa_appliance	cisco ucs invicta c3124sa appliance	eq	4.3.1
cisco:ucs_invicta_c3124sa_appliance	cisco ucs invicta c3124sa appliance	eq	4.3_base
cisco:ucs_invicta_c3124sa_appliance	cisco ucs invicta c3124sa appliance	eq	4.5.0
cisco:ucs_invicta_c3124sa_appliance	cisco ucs invicta c3124sa appliance	eq	4.5_base
cisco:ucs_invicta_c3124sa_appliance	cisco ucs invicta c3124sa appliance	eq	5.0.1
cisco:ucs_invicta_c3124sa_appliance	cisco ucs invicta c3124sa appliance	eq	5.0_base

References

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160524-ucs-inv

www.securitytracker.com/id/1035957

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

0.002 Low

EPSS

Percentile

55.1%

JSON

Related for CVE-2016-1404

nvd1 cisco1 cvelist1 prion1