====================================================================

                             CERT-Renater

                 Note d'Information No. 2018/VULN186
_____________________________________________________________________

DATE                : 17/05/2018

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Cisco Digital Network Architecture
                      software versions prior to Release 1.1.3.

=====================================================================
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180516-dnac
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180516-dna
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180516-dna2
_____________________________________________________________________

Cisco Security Advisory: Cisco Digital Network Architecture Center
Static Credentials Vulnerability

Advisory ID: cisco-sa-20180516-dnac

Revision: 1.0

For Public Release: 2018 May 16 16:00 GMT

Last Updated: 2018 May 16 16:00 GMT

CVE ID(s): CVE-2018-0222

CVSS Score v(3): 10.0 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

+---------------------------------------------------------------------

Summary

=======

A vulnerability in Cisco Digital Network Architecture (DNA) Center could
allow an unauthenticated, remote attacker to log in to an affected
system by using an administrative account that has default, static user
credentials.

The vulnerability is due to the presence of undocumented, static user
credentials for the default administrative account for the affected
software. An attacker could exploit this vulnerability by using the
account to log in to an affected system. A successful exploit could
allow the attacker to log in to the affected system and execute
arbitrary commands with root privileges.

Cisco has released software updates that address this vulnerability.
There are no workarounds that address this vulnerability.

This advisory is available at the following link:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180516-dnac
["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180516-dnac"]

____________________________________________________________________

Cisco Security Advisory: Cisco Digital Network Architecture Center
Unauthorized Access Vulnerability

Advisory ID: cisco-sa-20180516-dna

Revision: 1.0

For Public Release: 2018 May 16 16:00 GMT

Last Updated: 2018 May 16 16:00 GMT

CVE ID(s): CVE-2018-0268

CVSS Score v(3): 10.0 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

+---------------------------------------------------------------------

Summary

=======

A vulnerability in the container management subsystem of Cisco Digital
Network Architecture (DNA) Center could allow an unauthenticated, remote
attacker to bypass authentication and gain elevated privileges.

This vulnerability is due to an insecure default configuration of the
Kubernetes container management subsystem within DNA Center. An attacker
who has the ability to access the Kubernetes service port could execute
commands with elevated privileges within provisioned containers. A
successful exploit could result in a complete compromise of affected
containers.

  Cisco has released software updates that address this vulnerability.
There are no workarounds that address this vulnerability.

  This advisory is available at the following link:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180516-dna
["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180516-dna"]

_____________________________________________________________________

Cisco Security Advisory: Cisco Digital Network Architecture Center
Authentication Bypass Vulnerability

Advisory ID: cisco-sa-20180516-dna2

Revision: 1.0

For Public Release: 2018 May 16 16:00 GMT

Last Updated: 2018 May 16 16:00 GMT

CVE ID(s): CVE-2018-0271

CVSS Score v(3): 10.0 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

+---------------------------------------------------------------------

Summary

=======

A vulnerability in the API gateway of the Cisco Digital Network
Architecture (DNA) Center could allow an unauthenticated, remote
attacker to bypass authentication and access critical services.

The vulnerability is due to a failure to normalize URLs prior to
servicing requests. An attacker could exploit this vulnerability by
submitting a crafted URL designed to exploit the issue. A successful
exploit could allow the attacker to gain unauthenticated access to
critical services, resulting in elevated privileges in DNA Center.

Cisco has released software updates that address this vulnerability.
There are no workarounds that address this vulnerability.

This advisory is available at the following link:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180516-dna2
["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180516-dna2"]


==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================