Cisco Catalyst 3850 Series Switches和9300 Series Switches IOS XE 数据伪造问题漏洞

CNNVD-ID编号	CNNVD-201909-1126	CVE编号	CVE-2019-12649
发布时间	2019-09-25	更新时间	2019-10-17
漏洞类型	数据伪造问题	漏洞来源	ASIG – XB of Cisco during internal security testing
危险等级	中危	威胁类型	本地
厂商	N/A

漏洞介绍

Cisco Catalyst 3850 Series Switches和Cisco Catalyst 9300 Series Switches都是美国思科（Cisco）公司的产品。Cisco Catalyst 3850 Series Switches是一款3850系列交换机。Cisco Catalyst 9300 Series Switches是一款9300系列交换机。IOS XE是一套为其网络设备开发的操作系统。

Cisco Catalyst 3850 Series Switches和9300 Series Switches中的IOS XE的镜像验证功能存在数据伪造问题漏洞，该漏洞源于在特定环境中，受影响的设备会进行配置，不去验证系统镜像的数字签名。本地攻击者可利用该漏洞安装并启动恶意的软件镜像或执行未签名的二进制文件。

漏洞补丁

目前厂商已发布升级了Cisco Catalyst 3850 Series Switches和9300 Series Switches IOS XE 数据伪造问题漏洞的补丁，Cisco Catalyst 3850 Series Switches和9300 Series Switches IOS XE 数据伪造问题漏洞的补丁获取链接：

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-iosxe-digsig-bypass

参考网址

来源:tools.cisco.com

链接：https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-webui-cmd-injection
来源:tools.cisco.com

链接：https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-vman-cmd-injection
来源:tools.cisco.com

链接：https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-utd
来源:tools.cisco.com

链接：https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-ctspac-dos
来源:tools.cisco.com

链接：https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-xss
来源:tools.cisco.com

链接：https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-rawtcp-dos
来源:tools.cisco.com

链接：https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-dt
来源:tools.cisco.com

链接：https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-sip-alg
来源:tools.cisco.com

链接：https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-isdn-data-leak
来源:tools.cisco.com

链接：https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-iox-gs
来源:httpserv-dos

链接：httpserv-dos
来源:tools.cisco.com

链接：https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-iosxe-fsdos
来源:tools.cisco.com

链接：https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-ftp
来源:tools.cisco.com

链接：https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-iosxe-ctbypass
来源:tools.cisco.com

链接：https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-iosxe-codeexec
来源:tools.cisco.com

链接：https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-awr
来源:tools.cisco.com

链接：https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190925-iosxe-digsig-bypass
来源:www.auscert.org.au

链接：https://www.auscert.org.au/bulletins/ESB-2019.3615.2/
来源:vigilance.fr

链接：https://vigilance.fr/vulnerability/Cisco-IOS-XE-privilege-escalation-via-Digital-Signature-Verification-Bypass-30431
来源:www.auscert.org.au

链接：https://www.auscert.org.au/bulletins/ESB-2019.3615/

受影响实体

暂无

信息来源

http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201909-1126

Cisco Catalyst 3850 Series Switches和9300 Series Switches IOS XE 数据伪造问题漏洞

漏洞介绍

漏洞补丁

参考网址

受影响实体

信息来源

查询漏洞

相关漏洞

支持服务

云学院

合作与生态

Cisco Catalyst 3850 Series Switches和9300 Series Switches IOS XE 数据伪造问题漏洞

漏洞介绍

漏洞补丁

参考网址

受影响实体

信息来源

查询漏洞

相关漏洞