bugtraq - Cisco Security Advisory: Cisco Application Policy Infrastructure Controller Access Control Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-id: <201602031103.6.apic@psirt.cisco.com>
Date: Wed,  3 Feb 2016 11:03:23 -0500
From: Cisco Systems Product Security Incident Response Team <psirt@...co.com>
To: bugtraq@...urityfocus.com
Cc: psirt@...co.com
Subject: Cisco Security Advisory: Cisco Application Policy Infrastructure Controller Access Control Vulnerability

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Cisco Security Advisory: Cisco Application Policy Infrastructure Controller Access Control Vulnerability

Advisory ID: cisco-sa-20160203-apic

Revision: 1.0

For Public Release 2016 February 03 16:00 UTC (GMT)

+---------------------------------------------------------------------

Summary
=======

A vulnerability in the role-based access control (RBAC) of the Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated remote user to make configuration changes outside of their configured access privileges.  

The vulnerability is due to eligibility logic in the RBAC processing code. An authenticated user could exploit this vulnerability by sending specially crafted representational state transfer (REST) requests to the APIC. An exploit could allow the authenticated user to make configuration changes to the APIC beyond the configured privilege for their role.

Cisco has released software updates that address this vulnerability. 

This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160203-apic

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (SunOS)

iQIVAwUBVrCha689gD3EAJB5AQIpfhAAnB7qeHrfdjA/CSMgMk2VxNM9EkZrer2E
wizm4VxJyrLXC3rxVwmhObSsfgIGEzgRAhQ9iqX9FNL34OVVs6FTmxij7XRfCuVR
dIvNYQ/yT3e6siGQSKQjZ9K5GZ1bRHyCw9LyEqQwaWuWXg7/bCWM/FqluPngNn96
TRXSt1CM+ELV/tFSAUeu2jkHAyCLd9slwxmjh7Ti0LMVLeeQoUmXo81p08rRz1rV
JpWA2tr4HO4/e4+3cJS3oe5kLGy7b7e7vUX4auxnnD5ZZEvGABs/IC4PGqo33U1g
zQE1QrMBBxot5UcrHOnQEjfx9RJ8vEpw1GihemvLHcsCV0d4JWeS3FJzUnWXWOgT
G5/KCao/8hsTiqu8bs2M2c4hhfP/41XHO1wkCeZEJKUS9oaPhv8uF2ly1dr3uW68
YgSY1AW7CqxqiiLktryFoCS29JWqNsYGGW43NCwWImaVyFkL6TekqjGIZYuTkpO9
fT0Q/qBD+D1NhNeesesS3KGLdQ5kFpvl936vf2coesTtlkX2L/ItJjLCGLX1jhw0
+Qk8R8GNqnj55GIjaXL64cUcDPpu90PE1K4IG533WhmrxKgZ+RzMT1I0zEwDX8et
M7Z4mtlpv1owzvkIDjihUipAq8Hgj7qaNtB9sqNxlVSKxVFEI+JcWz/6DWGact7G
3ypCksBxTK0=
=dg7F
-----END PGP SIGNATURE-----