ID de Prueba:	1.3.6.1.4.1.25623.1.0.105319
Categoría:	CISCO
Título:	Multiple Cisco Products Default SSH Host Keys Security Bypass Vulnerability (cisco-sa-20150625-ironport)
Resumen:	Multiple Cisco products are prone to a security bypass vulnerability.
Descripción:	Summary: Multiple Cisco products are prone to a security bypass vulnerability. Vulnerability Insight: The vulnerability is due to the presence of default SSH host keys that are shared across all the installations of WSAv, ESAv, and SMAv. An attacker could exploit this vulnerability by obtaining one of the SSH private keys and using it to impersonate or decrypt communication between any WSAv, ESAv, or SMAv. An exploit could allow the attacker to decrypt and impersonate secure communication between any virtual content security appliances. Vulnerability Impact: An attacker can exploit this issue to bypass security restrictions and perform unauthorized actions. This may aid in further attacks. Affected Software/OS: Cisco Web Security Virtual Appliance (WSAv), Cisco Email Security Virtual Appliance (ESAv), and Cisco Security Management Virtual Appliance (SMAv) are affected. Solution: Updates are available. Please see the vendor advisory for more information. CVSS Score: 4.3 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2015-4217 BugTraq ID: 75418 http://www.securityfocus.com/bid/75418 Cisco Security Advisory: 20150625 Cisco Virtual WSA, ESA, and SMA Default SSH Host Keys Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=39461 Cisco Security Advisory: 20150625 Multiple Default SSH Keys Vulnerabilities in Cisco Virtual WSA, ESA, and SMA http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150625-ironport http://www.securitytracker.com/id/1032725 http://www.securitytracker.com/id/1032726
Copyright	Copyright (C) 2015 Greenbone AG

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.