Multiple Cisco Products CVE-2013-3384 Command Injection Vulnerability
BID:60805
Info
Multiple Cisco Products CVE-2013-3384 Command Injection Vulnerability
| Bugtraq ID: | 60805 |
| Class: | Input Validation Error |
| CVE: |
CVE-2013-3384 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 26 2013 12:00AM |
| Updated: | Jun 26 2013 12:00AM |
| Credit: | Cisco |
| Vulnerable: |
Cisco Web Security Appliance 7.5.1 Cisco Web Security Appliance 7.5 Cisco Web Security Appliance 7.1.4 Cisco Web Security Appliance 7.1.3 Cisco Web Security Appliance 7.1.2 Cisco Web Security Appliance 7.1.1 Cisco Web Security Appliance 7.1 Cisco Web Security Appliance 7.7 Cisco Email Security Appliance 7.6.2 Cisco Email Security Appliance 7.6.1 Cisco Email Security Appliance 7.6 Cisco Email Security Appliance 7.5.2 Cisco Email Security Appliance 7.5.1 Cisco Email Security Appliance 7.5 Cisco Email Security Appliance 7.3.2 Cisco Email Security Appliance 7.3.1 Cisco Email Security Appliance 7.3 Cisco Email Security Appliance 7.1.5 Cisco Email Security Appliance 7.1.4 Cisco Email Security Appliance 7.1.3 Cisco Email Security Appliance 7.1.2 Cisco Email Security Appliance 7.1.1 Cisco Email Security Appliance 7.1 Cisco Content Security Management Appliance 7.9.1 Cisco Content Security Management Appliance 7.9 Cisco Content Security Management Appliance 7.7.1 Cisco Content Security Management Appliance 7.7 Cisco Content Security Management Appliance 7.2.2 Cisco Content Security Management Appliance 7.2.1 Cisco Content Security Management Appliance 7.2 |
| Not Vulnerable: |
Cisco Web Security Appliance 7.7.0-550 Cisco Email Security Appliance 7.6.3-019 Cisco Content Security Management Appliance 7.9.1-102 |
Discussion
Multiple Cisco Products CVE-2013-3384 Command Injection Vulnerability
Multiple Cisco products are prone to a remote command-injection vulnerability because they fail to properly sanitize user-supplied input.
Successfully exploiting this issue may allow an attacker to execute arbitrary commands with elevated privileges in context of the affected application.
This issue being tracked by Cisco bug IDs CSCzv44633, CSCzv85726, and CSCzv24579.
The following are affected:
Versions prior to Cisco Web Security Appliance 7.7.0-550
Versions prior to Cisco Email Security Appliance 7.6.3-019
Versions prior to Cisco Content Security Management Appliance 7.9.1-102
Multiple Cisco products are prone to a remote command-injection vulnerability because they fail to properly sanitize user-supplied input.
Successfully exploiting this issue may allow an attacker to execute arbitrary commands with elevated privileges in context of the affected application.
This issue being tracked by Cisco bug IDs CSCzv44633, CSCzv85726, and CSCzv24579.
The following are affected:
Versions prior to Cisco Web Security Appliance 7.7.0-550
Versions prior to Cisco Email Security Appliance 7.6.3-019
Versions prior to Cisco Content Security Management Appliance 7.9.1-102
Exploit / POC
Multiple Cisco Products CVE-2013-3384 Command Injection Vulnerability
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Multiple Cisco Products CVE-2013-3384 Command Injection Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Multiple Cisco Products CVE-2013-3384 Command Injection Vulnerability
References:
References:
- Cisco Homepage (Cisco)