Cisco StarOS CVE-2017-6707 Local Command Injection Vulnerability

Bugtraq ID:	99462
Class:	Input Validation Error
CVE:	CVE-2017-6707
Remote:	No
Local:	Yes
Published:	Jul 05 2017 12:00AM
Updated:	Jul 05 2017 12:00AM
Credit:	Cisco
Vulnerable:	Cisco Virtualized Packet Core-Single Instance (VPC-SI) Software 0 Cisco Virtualized Packet Core-Distributed Instance (VPC-DI) Software 0 Cisco StarOS 0 Cisco ASR 5700 Series 0 Cisco ASR 5500 Series 0 Cisco ASR 5000 Series 0
Not Vulnerable:

Cisco StarOS CVE-2017-6707 Local Command Injection Vulnerability

Cisco StarOS is prone to a local command-injection vulnerability because it fails to properly sanitize user-supplied input.

Successfully exploiting this issue may allow an attacker to execute arbitrary commands with root privileges.

This issue is being tracked by Cisco bug ID's CSCvc69329 and CSCvc72930.

Cisco StarOS CVE-2017-6707 Local Command Injection Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Cisco StarOS CVE-2017-6707 Local Command Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Cisco StarOS CVE-2017-6707 Local Command Injection Vulnerability

References:

• Cisco Homepage (Cisco )
  
• Cisco StarOS CLI Command Injection Vulnerability (Cisco)