CVE-2017-6690 Path traversal in Cisco StarOS
An authenticated remote attacker can overwrite or modify arbitrary files on Cisco ASR 5000 routers via a file check operation vulnerability.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-6690?
CVE-2017-6690 is a medium-severity path traversal vulnerability in Cisco StarOS, published on 13 Jun 2017. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A vulnerability in the file check operation of Cisco ASR 5000 Series Aggregated Services Routers running the Cisco StarOS operating system could allow an authenticated, remote attacker to overwrite or modify arbitrary files on an affected system. More Information: CSCvd73726. Known Affected Releases: 21.0.v0.65839 21.3.M0.67005. Known Fixed Releases: 21.4.A0.67087 21.4.A0.67079 21.4.A0.67013 21.3.M0.67084 21.3.M0.67077 21.3.M0.66994 21.3.J0.66993 21.1.v0.67082 21.1.V0.67083.
Weakness: CWE-20
Which versions are affected by CVE-2017-6690?
It affects 1 product.
Products include Cisco Asr 5000 Software.
How do I fix CVE-2017-6690?
No fix has been published for CVE-2017-6690 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2017-6690 being exploited?
There is no known exploitation of CVE-2017-6690 in the wild and no public exploit code.
Other vulnerabilities in Cisco StarOS
- CVE-2017-6729 Denial of service in Cisco StarOS
- CVE-2016-6455 Denial of service in Cisco StarOS 18.x through 21.x
- CVE-2016-1436 Denial of service in n/a
- CVE-2017-6773 Command injection in StarOS for ASR 5000 Series Aggregated Services Routers
- CVE-2017-6775 Privilege escalation in StarOS for ASR 5000 Series Aggregated Services Routers
Sources
Also known as GHSA-39wf-75mq-q4p3.