cvelistv5 - cve-2016-6367

CVE-2016-6367 (GCVE-0-2016-6367)

Vulnerability from cvelistv5

Published

2016-08-18 18:00

Modified

2026-01-12 20:49

Severity ?

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

Summary

Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows local users to gain privileges via invalid CLI commands, aka Bug ID CSCtu74257 or EPICBANANA.

References

URL

Tags

	http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-cli	vendor-advisory, x_refsource_CISCO
	https://www.exploit-db.com/exploits/40271/	exploit, x_refsource_EXPLOIT-DB
	http://blogs.cisco.com/security/shadow-brokers	x_refsource_CONFIRM
	http://www.securitytracker.com/id/1036636	vdb-entry, x_refsource_SECTRACK
	http://tools.cisco.com/security/center/viewErp.x?alertId=ERP-56516	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/92520	vdb-entry, x_refsource_BID
	https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40271.zip	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

CISA Known Exploited Vulnerability

Data from the CISA Known Exploited Vulnerabilities Catalog

Date added: 2022-05-24

Due date: 2022-06-14

Required action: Apply updates per vendor instructions.

Used in ransomware: Unknown

Notes: https://nvd.nist.gov/vuln/detail/CVE-2016-6367

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T01:29:19.523Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20160817 Cisco Adaptive Security Appliance CLI Remote Code Execution Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-cli"
          },
          {
            "name": "40271",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/40271/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://blogs.cisco.com/security/shadow-brokers"
          },
          {
            "name": "1036636",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1036636"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://tools.cisco.com/security/center/viewErp.x?alertId=ERP-56516"
          },
          {
            "name": "92520",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/92520"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40271.zip"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2016-6367",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-08T17:38:49.876850Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2022-05-24",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-6367"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-77",
                "description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-12T20:49:46.066Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-6367"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-08-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows local users to gain privileges via invalid CLI commands, aka Bug ID CSCtu74257 or EPICBANANA."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-11-25T20:57:01.000Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "20160817 Cisco Adaptive Security Appliance CLI Remote Code Execution Vulnerability",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-cli"
        },
        {
          "name": "40271",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/40271/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://blogs.cisco.com/security/shadow-brokers"
        },
        {
          "name": "1036636",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1036636"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://tools.cisco.com/security/center/viewErp.x?alertId=ERP-56516"
        },
        {
          "name": "92520",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/92520"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40271.zip"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@cisco.com",
          "ID": "CVE-2016-6367",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows local users to gain privileges via invalid CLI commands, aka Bug ID CSCtu74257 or EPICBANANA."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20160817 Cisco Adaptive Security Appliance CLI Remote Code Execution Vulnerability",
              "refsource": "CISCO",
              "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-cli"
            },
            {
              "name": "40271",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/40271/"
            },
            {
              "name": "http://blogs.cisco.com/security/shadow-brokers",
              "refsource": "CONFIRM",
              "url": "http://blogs.cisco.com/security/shadow-brokers"
            },
            {
              "name": "1036636",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1036636"
            },
            {
              "name": "http://tools.cisco.com/security/center/viewErp.x?alertId=ERP-56516",
              "refsource": "CONFIRM",
              "url": "http://tools.cisco.com/security/center/viewErp.x?alertId=ERP-56516"
            },
            {
              "name": "92520",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/92520"
            },
            {
              "name": "https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40271.zip",
              "refsource": "MISC",
              "url": "https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40271.zip"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2016-6367",
    "datePublished": "2016-08-18T18:00:00.000Z",
    "dateReserved": "2016-07-26T00:00:00.000Z",
    "dateUpdated": "2026-01-12T20:49:46.066Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "cisa_known_exploited": {
      "cveID": "CVE-2016-6367",
      "cwes": "[\"CWE-77\"]",
      "dateAdded": "2022-05-24",
      "dueDate": "2022-06-14",
      "knownRansomwareCampaignUse": "Unknown",
      "notes": "https://nvd.nist.gov/vuln/detail/CVE-2016-6367",
      "product": "Adaptive Security Appliance (ASA)",
      "requiredAction": "Apply updates per vendor instructions.",
      "shortDescription": "A vulnerability in the command-line interface (CLI) parser of Cisco ASA software could allow an authenticated, local attacker to create a denial-of-service (DoS) condition or potentially execute code.",
      "vendorProject": "Cisco",
      "vulnerabilityName": "Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution Vulnerability"
    }
  }
}

CERTFR-2016-AVI-295

Vulnerability from certfr_avis

De multiples vulnérabilités ont été corrigées dans les pare-feux Cisco. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Cisco	N/A	Cisco Firewall Services Module (FWSM)
Cisco	N/A	Cisco ASA Services Module pour Cisco Catalyst 6500 Series Switches et Cisco 7600 Series Routers
Cisco	N/A	Cisco ASA 1000V Cloud Firewall
Cisco	N/A	Cisco Adaptive Security Virtual Appliance (ASAv)
Cisco	N/A	Cisco ASA 5500 Series Adaptive Security Appliances
Cisco	N/A	Cisco ASA 5500-X Series Next-Generation Firewalls
Cisco	N/A	Cisco Firepower 4100 Series
Cisco	N/A	Cisco Firepower 9300 ASA Security Module
Cisco	N/A	Cisco Industrial Security Appliance 3000
Cisco	Firepower Threat Defense	Cisco Firepower Threat Defense Software
Cisco	N/A	Cisco PIX Firewalls

References

Title

Publication Time

Tags

Bulletin de sécurité Cisco cisco-sa-20160817-asa-snmp du 17 août 2016	None	vendor-advisory
Bulletin de sécurité Cisco cisco-sa-20160817-asa-cli du 17 août 2016	None	vendor-advisory
Bulletin de sécurité Cisco cisco-sa-20160817-asa-cli du 17 août 2016	-	other
Bulletin de sécurité Cisco cisco-sa-20160817-asa-snmp du 17 août 2016	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Cisco Firewall Services Module (FWSM)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco ASA Services Module pour Cisco Catalyst 6500 Series Switches et Cisco 7600 Series Routers",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco ASA 1000V Cloud Firewall",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Adaptive Security Virtual Appliance (ASAv)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco ASA 5500 Series Adaptive Security Appliances",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco ASA 5500-X Series Next-Generation Firewalls",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Firepower 4100 Series",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Firepower 9300 ASA Security Module",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Industrial Security Appliance 3000",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Firepower Threat Defense Software",
      "product": {
        "name": "Firepower Threat Defense",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco PIX Firewalls",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2016-6367",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-6367"
    },
    {
      "name": "CVE-2016-6366",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-6366"
    }
  ],
  "initial_release_date": "2016-09-05T00:00:00",
  "last_revision_date": "2016-09-05T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160817-asa-cli du 17    ao\u00fbt 2016",
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-cli"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160817-asa-snmp du 17    ao\u00fbt 2016",
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-snmp"
    }
  ],
  "reference": "CERTFR-2016-AVI-295",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2016-09-05T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eles pare-feux Cisco\u003c/span\u003e. Elles permettent \u00e0 un\nattaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les pare-feux Cisco",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160817-asa-snmp du 17 ao\u00fbt 2016",
      "url": null
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Cisco cisco-sa-20160817-asa-cli du 17 ao\u00fbt 2016",
      "url": null
    }
  ]
}

CERTFR-2016-ALE-005

Vulnerability from certfr_alerte

De multiples vulnérabilités ont été découvertes dans les pare-feux Cisco. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance.

Description

Le samedi 13 août, des attaquants se faisant appeler les Shadow Brokers ont publiquement révélé des outils offensifs, qu'ils affirment provenir d'Equation, un groupe d'élite lié à la NSA.
Parmi ces outils se trouve du code malveillant dont la fonction est d'exploiter des vulnérabilités dans les pare-feux Cisco afin d'en prendre le contrôle.
Dans ses bulletins de sécurité cisco-sa-20160817-asa-snmp et cisco-sa-20160817-asa-cli (cf. Section Documentation), l'équipementier énumère la liste de produits pour lesquels un correctif est disponible.
Le CERT-FR recommande de durcir ses équipements tout en respectant les bonnes pratiques (cf. Section Documentation).
Des règles de détection réseau sont également disponibles, soit de manière payante (Cisco, cf. Section Documentation), soit à titre gratuit (Emerging Threats, cf. Section Documentation).

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation)

None

Impacted products

Vendor	Product	Description
Cisco	N/A	Cisco Firewall Services Module (FWSM)
Cisco	N/A	Cisco ASA Services Module pour Cisco Catalyst 6500 Series Switches et Cisco 7600 Series Routers
Cisco	N/A	Cisco ASA 1000V Cloud Firewall
Cisco	N/A	Cisco Adaptive Security Virtual Appliance (ASAv)
Cisco	N/A	Cisco ASA 5500 Series Adaptive Security Appliances
Cisco	N/A	Cisco ASA 5500-X Series Next-Generation Firewalls
Cisco	N/A	Cisco Firepower 4100 Series
Cisco	N/A	Cisco Firepower 9300 ASA Security Module
Cisco	N/A	Cisco Industrial Security Appliance 3000
Cisco	Firepower Threat Defense	Cisco Firepower Threat Defense Software
Cisco	N/A	Cisco PIX Firewalls

References

Title

Publication Time

Tags

Bulletin de sécurité cisco-sa-20160817-asa-snmp Cisco du 17 août 2016	None	vendor-advisory
Bulletin de sécurité cisco-sa-20160817-asa-cli Cisco du 17 août 2016	None	vendor-advisory
Avis CERTFR-2016-AVI-295	-	other
Règle de détection réseau Emerging Threats 2	-	other
Guide de durcissement des pare-feux Cisco ASA	-	other
Blog Cisco : Analyse de l'intégrité d'une image IOS	-	other
Guide de vérification d'intégrité ASA	-	other
Bulletin de sécurité cisco-sa-20160817-asa-cli Cisco du 17 août 2016	-	other
Guide de durcissement des équipements Cisco	-	other
Blog Cisco : The Shadow Brokers	-	other
Bulletin de sécurité cisco-sa-20160817-asa-snmp Cisco du 17 août 2016	-	other
Règle de détection réseau Emerging Threats 1	-	other
Annonce de fin de vie des Cisco Firewall Services Modules (FWSM)	-	other
Annonce de fin de vie des Cisco PIX Firewalls	-	other
Change logs des règles Snort soumises à abonnement	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Cisco Firewall Services Module (FWSM)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco ASA Services Module pour Cisco Catalyst 6500 Series Switches et Cisco 7600 Series Routers",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco ASA 1000V Cloud Firewall",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Adaptive Security Virtual Appliance (ASAv)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco ASA 5500 Series Adaptive Security Appliances",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco ASA 5500-X Series Next-Generation Firewalls",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Firepower 4100 Series",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Firepower 9300 ASA Security Module",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Industrial Security Appliance 3000",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Firepower Threat Defense Software",
      "product": {
        "name": "Firepower Threat Defense",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco PIX Firewalls",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Cisco",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "closed_at": "2016-09-05",
  "content": "## Description\n\nLe samedi 13 ao\u00fbt, des attaquants se faisant appeler les Shadow Brokers\nont publiquement r\u00e9v\u00e9l\u00e9 des outils offensifs, qu\u0027ils affirment provenir\nd\u0027Equation, un groupe d\u0027\u00e9lite li\u00e9 \u00e0 la NSA.  \nParmi ces outils se trouve du code malveillant dont la fonction est\nd\u0027exploiter des vuln\u00e9rabilit\u00e9s dans les pare-feux Cisco afin d\u0027en\nprendre le contr\u00f4le.  \nDans ses bulletins de s\u00e9curit\u00e9 cisco-sa-20160817-asa-snmp et\ncisco-sa-20160817-asa-cli (cf. Section Documentation), l\u0027\u00e9quipementier\n\u00e9num\u00e8re la liste de produits pour lesquels un correctif est\ndisponible.  \nLe CERT-FR recommande de durcir ses \u00e9quipements tout en respectant les\nbonnes pratiques (cf. Section Documentation).  \nDes r\u00e8gles de d\u00e9tection r\u00e9seau sont \u00e9galement disponibles, soit de\nmani\u00e8re payante (Cisco, cf. Section Documentation), soit \u00e0 titre gratuit\n(Emerging Threats, cf. Section Documentation).\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation)\n",
  "cves": [
    {
      "name": "CVE-2016-6366",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-6366"
    },
    {
      "name": "CVE-2016-6367",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-6367"
    }
  ],
  "initial_release_date": "2016-08-18T00:00:00",
  "last_revision_date": "2016-09-05T00:00:00",
  "links": [
    {
      "title": "Avis CERTFR-2016-AVI-295",
      "url": "http://www.cert.ssi.gouv.fr/site/CERTFR-2016-AVI-295"
    },
    {
      "title": "R\u00e8gle de d\u00e9tection r\u00e9seau Emerging Threats 2",
      "url": "http://doc.emergingthreats.net/bin/view/Main/2023071"
    },
    {
      "title": "Guide de durcissement des pare-feux Cisco ASA",
      "url": "http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/200150-Cisco-Guide-to-Harden-Cisco-ASA-Firewall.html"
    },
    {
      "title": "Blog Cisco : Analyse de l\u0027int\u00e9grit\u00e9 d\u0027une image IOS",
      "url": "https://blogs.cisco.com/security/offline-analysis-of-ios-image-integrity"
    },
    {
      "title": "Guide de v\u00e9rification d\u0027int\u00e9grit\u00e9 ASA",
      "url": "http://www.cisco.com/c/en/us/about/security-center/intelligence/asa-integrity-assurance.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 cisco-sa-20160817-asa-cli Cisco du 17    ao\u00fbt 2016",
      "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-cli"
    },
    {
      "title": "Guide de durcissement des \u00e9quipements Cisco",
      "url": "https://www.cisco.com/c/en/us/support/docs/ip/access-lists/13608-21.html"
    },
    {
      "title": "Blog Cisco : The Shadow Brokers",
      "url": "http://blogs.cisco.com/security/shadow-brokers"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 cisco-sa-20160817-asa-snmp Cisco du 17    ao\u00fbt 2016",
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160817-asa-snmp"
    },
    {
      "title": "R\u00e8gle de d\u00e9tection r\u00e9seau Emerging Threats 1",
      "url": "http://docs.emergingthreats.net/bin/view/Main/2023070"
    },
    {
      "title": "Annonce de fin de vie des Cisco Firewall Services Modules    (FWSM)",
      "url": "http://www.cisco.com/c/en/us/products/collateral/interfaces-modules/catalyst-6500-series-firewall-services-module/eol_c51-699134.html"
    },
    {
      "title": "Annonce de fin de vie des Cisco PIX Firewalls",
      "url": "http://www.cisco.com/c/en/us/products/security/pix-500-series-security-appliances/eos-eol-notice-listing.html"
    },
    {
      "title": "Change logs des r\u00e8gles Snort soumises \u00e0 abonnement",
      "url": "https://www.snort.org/advisories/talos-rules-2016-08-16"
    }
  ],
  "reference": "CERTFR-2016-ALE-005",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2016-08-18T00:00:00.000000"
    },
    {
      "description": "ajout de produits sur la liste des syst\u00e8mes affect\u00e9s ainsi que les annonces de fin de vie des produits Cisco Firewall Services Module et Cisco PIX Firewalls.",
      "revision_date": "2016-08-23T00:00:00.000000"
    },
    {
      "description": "cl\u00f4ture de l\u0027alerte.",
      "revision_date": "2016-09-05T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans \u003cspan\nclass=\"textit\"\u003eles pare-feux Cisco\u003c/span\u003e. Elles permettent \u00e0 un\nattaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les pare-feux Cisco",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 cisco-sa-20160817-asa-snmp Cisco du 17 ao\u00fbt 2016",
      "url": null
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 cisco-sa-20160817-asa-cli Cisco du 17 ao\u00fbt 2016",
      "url": null
    }
  ]
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2016-6367 (GCVE-0-2016-6367)

Vulnerability from cvelistv5

CISA Known Exploited Vulnerability

Data from the CISA Known Exploited Vulnerabilities Catalog

CERTFR-2016-AVI-295

Vulnerability from certfr_avis

Solution

CERTFR-2016-ALE-005

Vulnerability from certfr_alerte

Description

Solution

Tags

Sightings

Nomenclature