—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1

Cisco Security Advisory: Cisco Ultra Services Framework AutoVNF Log File User Credential Information Disclosure Vulnerability

Advisory ID: cisco-sa-20170705-usf2

Revision: 1.0

For Public Release: 2017 July 5 16:00 GMT

Last Updated: 2017 July 5 16:00 GMT

CVE ID(s): CVE-2017-6709

CVSS Score v(3): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

+———————————————————————

Summary
=======
A vulnerability in the AutoVNF tool for the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to access administrative credentials for Cisco Elastic Services Controller (ESC) and Cisco OpenStack deployments in an affected system.

The vulnerability exists because the affected software logs administrative credentials in clear text for Cisco ESC and Cisco OpenStack deployment purposes. An attacker could exploit this vulnerability by accessing the AutoVNF URL for the location where the log files are stored and subsequently accessing the administrative credentials that are stored in clear text in those log files. A successful exploit could allow the attacker to access the administrative credentials for Cisco ESC and Cisco OpenStack deployments in the affected system, which the attacker could use to conduct additional attacks.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170705-usf2 [“https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170705-usf2”]

—–BEGIN PGP SIGNATURE—–

iQKBBAEBAgBrBQJZXQ8BZBxDaXNjbyBTeXN0ZW1zIFByb2R1Y3QgU2VjdXJpdHkg
SW5jaWRlbnQgUmVzcG9uc2UgVGVhbSAoQ2lzY28gUFNJUlQga2V5IDIwMTYtMjAx
NykgPHBzaXJ0QGNpc2NvLmNvbT4ACgkQrz2APcQAkHmZXRAAgTMMRlPMG4/lh1al
jE+VEXZx+oCd4aFkYRD3s7/m69DGYZ08QjtlAa5Ocl3I96havrUOqTfpj8sxXvBJ
GE/XzhQCnsoR7EySd0FbIdLGNQtgfmPaDLJpJTDQN98R29C9PVi3E9voWXudubkd
5msIPeEdr4c5CZWKE8mejPsaX/ormA1sBjx/JxaO9WWAwfBuKJGObNx2fX8QTN1c
ynFj5NWjr7uMHARMoHdPu4W4b9ltEVOWV3jhKr+oxFkGGwUcye71YTF+hDtPLxRN
kW8N9NpPLR+WzZTa8FuAy9JTJPpxyvElPPYVsq0znuZSSzjQtMHsQ2QtZi4RxV4e
jUz5pqkOlqTVC5VX8OvwZ30K2rMcR8WkEM3EUiXMGMNVIRJ8twCZ7ThXb3LGjEDQ
viyEWoUOb8lnqnkwpq6sxJzQAvm3yvwWSBlB6XZ7WoeyYpUnKVVm0RQlGKF9UFk/
u5OI24L6Yhl2yuVMMx9Tp+ctsLmD8lQIj0dEtlAlg3+vba50DHX1Dg7skQ4ZAWPx
KXhBhqJnxZ7etDpCVsyDnvk9JPOccXbPbGza5PLqfHYTvttzXA+CZrkFArc51jjf
G9eifsB0uwZr4Jx4iTsNuh1fY1z+2mzHB3JAnLPPB8Kj3W6VXyATIgI5ucAs/SAj
YHwq7LFhCA0+/5TdbZdno6zh0lo=
=64fQ
—–END PGP SIGNATURE—–

_______________________________________________
cust-security-announce mailing list
cust-security-announce@cisco.com
To unsubscribe, send the command “unsubscribe” in the subject of your message to cust-security-announce-leave@cisco.com