CVE-2015-4217
published 2015-06-26CVE-2015-4217: The remote-support feature on Cisco Web Security Virtual Appliance (WSAv), Email Security Virtual Appliance (ESAv), and Security Management Virtual Appliance…
PriorityP425medium4.3CVSS 2.0
AVNACMAuNCPINAN
EPSS
2.24%
80.9th percentile
The remote-support feature on Cisco Web Security Virtual Appliance (WSAv), Email Security Virtual Appliance (ESAv), and Security Management Virtual Appliance (SMAv) devices before 2015-06-25 uses the same default SSH host keys across different customers' installations, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of a private key from another installation, aka Bug IDs CSCus29681, CSCuu95676, and CSCuu96601.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | content_security_management_virtual_appliance | — | — |
| cisco | content_security_management_virtual_appliance | — | — |
| cisco | email_security_virtual_appliance | — | — |
| cisco | email_security_virtual_appliance | — | — |
| cisco | email_security_virtual_appliance | — | — |
| cisco | email_security_virtual_appliance | — | — |
| cisco | web_security_virtual_appliance | — | — |
| cisco | web_security_virtual_appliance | — | — |
| cisco | web_security_virtual_appliance | — | — |
| cisco | web_security_virtual_appliance | — | — |
| cisco | web_security_virtual_appliance | — | — |
| cisco | web_security_virtual_appliance | — | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
vendor_cisco9.3CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-rwpv-8h6r-wrrr: The remote-support feature on Cisco Web Security Virtual Appliance (WSAv), Email Security Virtual Appliance (ESAv), and Security Management Virtual Ap
ghsa_unreviewed·2022-05-17
CVE-2015-4217 [MEDIUM] CWE-200 GHSA-rwpv-8h6r-wrrr: The remote-support feature on Cisco Web Security Virtual Appliance (WSAv), Email Security Virtual Appliance (ESAv), and Security Management Virtual Ap
The remote-support feature on Cisco Web Security Virtual Appliance (WSAv), Email Security Virtual Appliance (ESAv), and Security Management Virtual Appliance (SMAv) devices before 2015-06-25 uses the same default SSH host keys across different customers' installations, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of a private key from another installation, aka Bug IDs CSCus29681, CSCuu95676, and CSCuu96601.
Cisco
Cisco Virtual WSA, ESA, and SMA Default SSH Host Keys Vulnerability
vendor_cisco·2015-06-25·CVSS 4.3
CVE-2015-4217 [MEDIUM] CWE-310 Cisco Virtual WSA, ESA, and SMA Default SSH Host Keys Vulnerability
Cisco Virtual WSA, ESA, and SMA Default SSH Host Keys Vulnerability
A vulnerability in the remote support functionality of Cisco WSAv, Cisco ESAv, and Cisco SMAv Software could allow an unauthenticated, remote attacker to decrypt and impersonate secure communication between any virtual content security appliances.
The vulnerability is due to the presence of default SSH host keys that are shared across all the installations of WSAv, ESAv, and SMAv. An attacker could exploit this vulnerability by obtaining one of the SSH private keys and using it to impersonate or decrypt communication between any WSAv, ESAv, or SMAv. An exploit could allow the attacker to decrypt and impersonate secure communication between any virtual content security appliances.
Cisco has confirmed the vulnerability in
Cisco
Multiple Default SSH Keys Vulnerabilities in Cisco Virtual WSA, ESA, and SMA
vendor_cisco·2015-06-25·CVSS 9.3
CVE-2015-4216 [CRITICAL] CWE-310 Multiple Default SSH Keys Vulnerabilities in Cisco Virtual WSA, ESA, and SMA
Multiple Default SSH Keys Vulnerabilities in Cisco Virtual WSA, ESA, and SMA
Cisco Web Security Virtual Appliance (WSAv), Cisco Email Security Virtual Appliance (ESAv), and Cisco Security Management Virtual Appliance (SMAv) are affected by the following vulnerabilities:
Cisco Virtual WSA, ESA, and SMA Default Authorized SSH Key Vulnerability
Cisco Virtual WSA, ESA, and SMA Default SSH Host Keys Vulnerability
Cisco has released software updates that address these vulnerabilities.
There are no workarounds for these vulnerabilities.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150625-ironport
Cisco
Multiple Default SSH Keys Vulnerabilities in Cisco Virtual WSA, ESA, and SMA
vendor_cisco
CVE-2015-4217 Multiple Default SSH Keys Vulnerabilities in Cisco Virtual WSA, ESA, and SMA
CVE-2015-4217: Multiple Default SSH Keys Vulnerabilities in Cisco Virtual WSA, ESA, and SMA
Cisco Web Security Virtual Appliance (WSAv), Cisco Email Security Virtual Appliance (ESAv), and Cisco Security Management Virtual Appliance (SMAv) are affected by the following vulnerabilities: Cisco Virtual WSA, ESA, and SMA Default Authorized SSH Key Vulnerability Cisco Virtual WSA, ESA, and SMA Default SSH Host Keys Vulnerability Cisco has released software updates that address these vulnerabilities. There are no
CWE: CWE-310, CWE-310
Bug IDs: CSCus29681, CSCuu95676, CSCuu95988, CSCus29681, CSCuu95676
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150625-ironporthttp://tools.cisco.com/security/center/viewAlert.x?alertId=39461http://www.securityfocus.com/bid/75418http://www.securitytracker.com/id/1032725http://www.securitytracker.com/id/1032726http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150625-ironporthttp://tools.cisco.com/security/center/viewAlert.x?alertId=39461http://www.securityfocus.com/bid/75418http://www.securitytracker.com/id/1032725http://www.securitytracker.com/id/1032726
2015-06-26
Published