====================================================================

                             CERT-Renater

                 Note d'Information No. 2018/VULN066
_____________________________________________________________________

DATE                : 22/02/2018

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Cisco Elastic Services Controller
                                       Service Portal.

=====================================================================
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-esc
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-esc1
_____________________________________________________________________

Cisco Security Advisory: Cisco Elastic Services Controller Service
Portal Authentication Bypass Vulnerability

Advisory ID: cisco-sa-20180221-esc

Revision: 1.0

For Public Release: 2018 February 21 16:00 GMT

Last Updated: 2018 February 21 16:00 GMT

CVE ID(s): CVE-2018-0121

CVSS Score v(3): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

+---------------------------------------------------------------------

Summary
=======
A vulnerability in the authentication functionality of the web-based
service portal of Cisco Elastic Services Controller Software could allow
an unauthenticated, remote attacker to bypass authentication and execute
arbitrary actions with administrator privileges on an affected system.

The vulnerability is due to improper security restrictions that are
imposed by the web-based service portal of the affected software. An
attacker could exploit this vulnerability by submitting an empty
password value to an affected portal when prompted to enter an
administrative password for the portal. A successful exploit could allow
the attacker to bypass authentication and gain administrator privileges
for the web-based service portal of the affected software.

Cisco has released software updates that address this vulnerability.
There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-esc
["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-esc"]

_____________________________________________________________________

Cisco Security Advisory: Cisco Elastic Services Controller Service
Portal Unauthorized Access Vulnerability

Advisory ID: cisco-sa-20180221-esc1

Revision: 1.0

For Public Release: 2018 February 21 16:00 GMT

Last Updated: 2018 February 21 16:00 GMT

CVE ID(s): CVE-2018-0130

CVSS Score v(3): 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

+---------------------------------------------------------------------

Summary
=======
A vulnerability in the use of JSON web tokens by the web-based service
portal of Cisco Elastic Services Controller Software could allow an
unauthenticated, remote attacker to gain administrative access to an
affected system.

The vulnerability is due to the presence of static default credentials
for the web-based service portal of the affected software. An attacker
could exploit this vulnerability by extracting the credentials from an
image of the affected software and using those credentials to generate a
valid administrative session token for the web-based service portal of
any other installation of the affected software. A successful exploit
could allow the attacker to gain administrative access to the web-based
service portal of an affected system.

Cisco has released software updates that address this vulnerability.
There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-esc1
["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-esc1"]


==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================