====================================================================


                             CERT-Renater

                 Note d'Information No. 2018/VULN274
_____________________________________________________________________

DATE                : 06/09/2018

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Cisco Umbrella ERC versions prior
                                    to 2.1.118,
               Cisco Umbrella Roaming Module versions prior to 4.6.1098.

=====================================================================
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-umbrella-priv
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-umbrella-file-read
_____________________________________________________________________

Cisco Security Advisory: Cisco Umbrella Enterprise Roaming Client and
Enterprise Roaming Module Privilege Escalation Vulnerability

Advisory ID: cisco-sa-20180905-umbrella-priv

Revision: 1.0

For Public Release: 2018 September 5 16:00 GMT

Last Updated: 2018 September 5 16:00 GMT

CVE ID(s): CVE-2018-0437

CVSS Score v(3): 7.8 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

+---------------------------------------------------------------------

Summary

=======

A vulnerability in the Cisco Umbrella Enterprise Roaming Client (ERC)
could allow an authenticated, local attacker to elevate privileges to
Administrator. To exploit the vulnerability, the attacker must
authenticate with valid local user credentials.

This vulnerability is due to improper implementation of file system
permissions, which could allow non-administrative users to place files
within restricted directories. An attacker could exploit this
vulnerability by placing an executable file within the restricted
directory, which when executed by the ERC client, would run with
Administrator privileges.

Cisco has released software updates that address this vulnerability.
There are no workarounds that address this vulnerability.

This advisory is available at the following link:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-umbrella-priv
["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-umbrella-priv"]

_______________________________________________________________

Cisco Security Advisory: Cisco Umbrella Enterprise Roaming Client
Privilege Escalation Vulnerability

Advisory ID: cisco-sa-20180905-umbrella-file-read

Revision: 1.0

For Public Release: 2018 September 5 16:00 GMT

Last Updated: 2018 September 5 16:00 GMT

CVE ID(s): CVE-2018-0438

CVSS Score v(3): 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

+---------------------------------------------------------------------

Summary

=======

A vulnerability in the Cisco Umbrella Enterprise Roaming Client (ERC)
could allow an authenticated, local attacker to elevate privileges to
Administrator. To exploit the vulnerability, the attacker must
authenticate with valid local user credentials.

This vulnerability is due to improper implementation of file system
permissions, which could allow non-administrative users to place files
within restricted directories. An attacker could exploit this
vulnerability by placing an executable file within the restricted
directory, which when executed by the ERC client, would run with
Administrator privileges.

Cisco has released software updates that address this vulnerability.
There are no workarounds that address this vulnerability.

This advisory is available at the following link:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-umbrella-file-read
["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-umbrella-file-read"]

=========================================================
+ CERT-RENATER        | tel : 01-53-94-20-44            +
+ 23/25 Rue Daviel    | fax : 01-53-94-20-41            +
+ 75013 Paris         | email:cert@support.renater.fr   +
=========================================================