Cisco Stackable Managed Switch SSH Subsystem Message memory corruption

Summaryinfo

A vulnerability categorized as problematic has been discovered in Cisco Stackable Managed Switch. Affected by this issue is some unknown functionality of the component SSH Subsystem. Executing a manipulation as part of Message can lead to memory corruption. The identification of this vulnerability is CVE-2017-6720. The attack may be launched remotely. There is no exploit available. Modifying the configuration settings is advised.

Detailsinfo

A vulnerability was found in Cisco Stackable Managed Switch (affected version unknown). It has been declared as problematic. This vulnerability affects an unknown functionality of the component SSH Subsystem. The manipulation as part of a Message leads to a memory corruption vulnerability. The CWE definition for the vulnerability is CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. As an impact it is known to affect availability. CVE summarizes:

A vulnerability in the Secure Shell (SSH) subsystem of Cisco Small Business Managed Switches software could allow an authenticated, remote attacker to cause a reload of the affected switch, resulting in a denial of service (DoS) condition. The vulnerability is due to improper processing of SSH connections. An attacker could exploit this vulnerability by logging in to an affected switch via SSH and sending a malicious SSH message. This vulnerability affects the following Cisco products when SSH is enabled: Small Business 300 Series Managed Switches, Small Business 500 Series Stackable Managed Switches, 350 Series Managed Switches, 350X Series Stackable Managed Switches, 550X Series Stackable Managed Switches, ESW2 Series Advanced Switches. Cisco Bug IDs: CSCvb48377.

The bug was discovered 09/20/2017. The weakness was shared 09/21/2017 as cisco-sa-20170920-sbms as confirmed advisory (Website). The advisory is available at tools.cisco.com. This vulnerability was named CVE-2017-6720 since 03/09/2017. The attack can be initiated remotely. The successful exploitation needs a single authentication. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 01/13/2021).

The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $5k-$25k.

It is possible to mitigate the problem by applying the configuration setting .Proper firewalling of tcp/22 (ssh) is able to address this issue. The best possible mitigation is suggested to be the change of configuration settings.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 100933†). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Cisco

Name

• Stackable Managed Switch

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion