CVE-2017-3837 (GCVE-0-2017-3837)
Vulnerability from cvelistv5
Published
2017-02-22 02:00
Modified
2024-08-05 14:39
Severity ?
CWE
  • HTTP Packet Processing Vulnerability
Summary
An HTTP Packet Processing vulnerability in the Web Bridge interface of the Cisco Meeting Server (CMS), formerly Acano Conferencing Server, could allow an authenticated, remote attacker to retrieve memory contents, which could lead to the disclosure of confidential information. In addition, the attacker could potentially cause the application to crash unexpectedly, resulting in a denial of service (DoS) condition. The attacker would need to be authenticated and have a valid session with the Web Bridge. Affected Products: This vulnerability affects Cisco Meeting Server software releases prior to 2.1.2. This product was previously known as Acano Conferencing Server. More Information: CSCvc89551. Known Affected Releases: 2.0 2.0.7 2.1. Known Fixed Releases: 2.1.2.
References
Impacted products
Vendor Product Version
n/a Cisco Meeting Server Version: Cisco Meeting Server
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T14:39:41.078Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "1037834",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1037834"
          },
          {
            "name": "96243",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/96243"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170215-cms1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Cisco Meeting Server",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Cisco Meeting Server"
            }
          ]
        }
      ],
      "datePublic": "2017-02-21T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "An HTTP Packet Processing vulnerability in the Web Bridge interface of the Cisco Meeting Server (CMS), formerly Acano Conferencing Server, could allow an authenticated, remote attacker to retrieve memory contents, which could lead to the disclosure of confidential information. In addition, the attacker could potentially cause the application to crash unexpectedly, resulting in a denial of service (DoS) condition. The attacker would need to be authenticated and have a valid session with the Web Bridge. Affected Products: This vulnerability affects Cisco Meeting Server software releases prior to 2.1.2. This product was previously known as Acano Conferencing Server. More Information: CSCvc89551. Known Affected Releases: 2.0 2.0.7 2.1. Known Fixed Releases: 2.1.2."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "HTTP Packet Processing Vulnerability",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-07-24T12:57:01",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "1037834",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1037834"
        },
        {
          "name": "96243",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/96243"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170215-cms1"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@cisco.com",
          "ID": "CVE-2017-3837",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Cisco Meeting Server",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Cisco Meeting Server"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An HTTP Packet Processing vulnerability in the Web Bridge interface of the Cisco Meeting Server (CMS), formerly Acano Conferencing Server, could allow an authenticated, remote attacker to retrieve memory contents, which could lead to the disclosure of confidential information. In addition, the attacker could potentially cause the application to crash unexpectedly, resulting in a denial of service (DoS) condition. The attacker would need to be authenticated and have a valid session with the Web Bridge. Affected Products: This vulnerability affects Cisco Meeting Server software releases prior to 2.1.2. This product was previously known as Acano Conferencing Server. More Information: CSCvc89551. Known Affected Releases: 2.0 2.0.7 2.1. Known Fixed Releases: 2.1.2."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "HTTP Packet Processing Vulnerability"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "1037834",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1037834"
            },
            {
              "name": "96243",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/96243"
            },
            {
              "name": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170215-cms1",
              "refsource": "CONFIRM",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170215-cms1"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2017-3837",
    "datePublished": "2017-02-22T02:00:00",
    "dateReserved": "2016-12-21T00:00:00",
    "dateUpdated": "2024-08-05T14:39:41.078Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2017-3837\",\"sourceIdentifier\":\"psirt@cisco.com\",\"published\":\"2017-02-22T02:59:00.450\",\"lastModified\":\"2025-04-20T01:37:25.860\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An HTTP Packet Processing vulnerability in the Web Bridge interface of the Cisco Meeting Server (CMS), formerly Acano Conferencing Server, could allow an authenticated, remote attacker to retrieve memory contents, which could lead to the disclosure of confidential information. In addition, the attacker could potentially cause the application to crash unexpectedly, resulting in a denial of service (DoS) condition. The attacker would need to be authenticated and have a valid session with the Web Bridge. Affected Products: This vulnerability affects Cisco Meeting Server software releases prior to 2.1.2. This product was previously known as Acano Conferencing Server. More Information: CSCvc89551. Known Affected Releases: 2.0 2.0.7 2.1. Known Fixed Releases: 2.1.2.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad de HTTP Packet Processing en la interfaz Web Bridge de Cisco Meeting Server (CMS), anteriormente Acano Conferencing Server, podr\u00eda permitir a un atacante remoto autenticado recuperar contenidos de la memoria, lo que podr\u00eda conducir a la divulgaci\u00f3n de informaci\u00f3n confidencial. Adem\u00e1s, el atacante podr\u00eda provocar potencialmente que la aplicaci\u00f3n se bloqueara de forma inesperada, resultando en una condici\u00f3n de denegaci\u00f3n de servicio (DoS). El atacante necesitar\u00eda estar autenticado y tener una sesi\u00f3n validada con Web Bridge. Productos Afectados: Esta vulnerabilidad afecta a lanzamientos de software Cisco Meeting Server anteriores a 2.1.2. Este producto fue previamente conocido como Acano Conferencing Server. M\u00e1s Informaci\u00f3n: CSCvc89551. Lanzamientos Afectados Conocidos: 2.0 2.0.7 2.1. Lanzamientos Reparados Conocidos: 2.1.2.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.2}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:P/I:N/A:P\",\"baseScore\":5.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.0,\"impactScore\":4.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:meeting_server:2.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C48DC084-1DD2-4878-B1DB-1035CAE3B918\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:meeting_server:2.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1CA9A904-9AB5-4757-ABD1-0F6F933799BE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:meeting_server:2.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8FA8A21E-97BA-4326-9F7B-FCBD480134EF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:meeting_server:2.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1E6FA3F5-752D-45AB-A8CB-6488F409D933\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:meeting_server:2.0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4B80C9BA-07EC-4183-9AAD-3229913C9FD7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:meeting_server:2.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9B1895DF-AFB1-4B6E-A42C-38F7E19A5842\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:meeting_server:2.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3BC4BC50-1D9C-42F3-A88F-FE1E2C8A6C76\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:meeting_server:2.0.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA671C18-10F2-4A45-8D1C-BF460ECA84B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:meeting_server:2.0.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F618372C-0913-4773-9267-A835F31FA776\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:meeting_server:2.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B310B39B-7D5D-4533-9FE6-5F47985E35B0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:meeting_server:2.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B2720CCF-3B73-4268-94C7-9AE3D1ECAC75\"}]}]}],\"references\":[{\"url\":\"http://www.securityfocus.com/bid/96243\",\"source\":\"psirt@cisco.com\"},{\"url\":\"http://www.securitytracker.com/id/1037834\",\"source\":\"psirt@cisco.com\"},{\"url\":\"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170215-cms1\",\"source\":\"psirt@cisco.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/96243\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securitytracker.com/id/1037834\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170215-cms1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.