====================================================================

                              CERT-Renater

                 Note d'Information No. 2017/VULN324
_____________________________________________________________________

DATE                : 02/11/2017

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Cisco Identity Services Engine software versions
                                   1.4, 2.0, 2.0.1, 2.1.0.

=====================================================================
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171101-ise
____________________________________________________________________

Cisco Security Advisory: Cisco Identity Services Engine Privilege
Escalation Vulnerability

Advisory ID: cisco-sa-20171101-ise

Revision: 1.0

For Public Release: 2017 November 1 16:00 GMT

Last Updated: 2017 November 1 16:00 GMT

CVE ID(s): CVE-2017-12261

CVSS Score v(3): 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

+---------------------------------------------------------------------

Summary
=======
A vulnerability in the restricted shell of the Cisco Identity Services
Engine (ISE) that is accessible via SSH could allow an authenticated,
local attacker to run arbitrary CLI commands with elevated privileges.

The vulnerability is due to incomplete input validation of the user
input for CLI commands issued at the restricted shell. An attacker
could exploit this vulnerability by authenticating to the targeted
device and executing commands that could lead to elevated privileges.
An attacker would need valid user credentials to the device to exploit
this vulnerability.

Cisco has released software updates that address this vulnerability.
There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171101-ise
["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171101-ise"]


==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================