CVE-2018-0221— Cisco Identity Services Engine 命令注入漏洞

N/A

A vulnerability in specific CLI commands for the Cisco Identity Services Engine (ISE) could allow an authenticated, local attacker to perform command injection to the underlying operating system or cause a hang or disconnect of the user session. The attacker needs valid administrator credentials for the device. The vulnerability is due to incomplete input validation of user input for certain CLI ISE configuration commands. An attacker could exploit this vulnerability by authenticating as an administrative user, issuing a specific CLI command, and entering crafted, malicious user input for the command parameters. An exploit could allow the attacker to perform command injection to the lower-level Linux operating system. It is also possible the attacker could cause the ISE user interface for this management session to hang or disconnect. Cisco Bug IDs: CSCvg95479.

N/A

OS命令中使用的特殊元素转义处理不恰当(OS命令注入)

Cisco Identity Services Engine 命令注入漏洞

Cisco Identity Services Engine（ISE）是美国思科（Cisco）公司的一款基于身份的环境感知平台（ISE身份服务引擎）。该平台通过收集网络、用户和设备中的实时信息，制定并实施相应策略来监管网络。 Cisco ISE中的CLI命令存在命令注入漏洞，该漏洞源于程序没有充分对用户输入中的CLI ISE配置命令执行输入验证。本地攻击者可通过认证为管理用户，发送CLI命令并向命令参数中注入恶意的输入利用该漏洞向底层操作系统中注入命令或造成用户会话挂起或断开。

N/A

N/A