Vulnerabilities
Misconfiguration
Runtime Security
Compliance
CVE Vulnerabilities

CVE-2016-1335

Published: Feb 19, 2016 | Modified: Aug 04, 2016
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
7.1 HIGH
AV:N/AC:H/Au:S/C:C/I:C/A:C
RedHat/V2
RedHat/V3
Ubuntu
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2016-1335
CWEhttps://cwe.mitre.org/data/definitions/264.html

The SSH implementation in Cisco StarOS before 19.3.M0.62771 and 20.x before 20.0.M0.62768 on ASR 5000 devices mishandles a multi-user public-key authentication configuration, which allows remote authenticated users to gain privileges by establishing a connection from an endpoint that was previously used for an administrators connection, aka Bug ID CSCux22492.

Affected Software

Name Vendor Start Version End Version
Asr_5000_series_software Cisco 19.3.0 19.3.0
Asr_5000_series_software Cisco 18.4.0 18.4.0
Asr_5000_series_software Cisco 20.0.0 20.0.0
Asr_5000_series_software Cisco 17.7.0 17.7.0
Asr_5000_series_software Cisco 19.0.1 19.0.1
Asr_5000_series_software Cisco 16.5.2 16.5.2

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2023 Aqua Security Software Ltd.   Privacy Policy | Terms of Use