Sign-up

ID

VAR-201606-0279


CVE

CVE-2016-1427


TITLE

Cisco Prime Network Registrar System Configuration Protocol Core Messaging Interface Vulnerability Obtaining Important Information

Trust: 0.8

sources: JVNDB: JVNDB-2016-003293

DESCRIPTION

The System Configuration Protocol (SCP) core messaging interface in Cisco Prime Network Registrar 8.2 before 8.2.3.1 and 8.3 before 8.3.2 allows remote attackers to obtain sensitive information via crafted SCP messages, aka Bug ID CSCuv35694. The Cisco PrimeNetwork Registrar (CPNR) is a network registrar product from Cisco. The product provides services such as Dynamic Host Configuration Protocol (DHCP), Domain Name System (DNS), and IP Address Management (IPAM). A security vulnerability exists in the SystemMessageProtocol (SCP) core message interface prior to CPNR 8.2.3.1 and 8.3 versions prior to 8.3.2. This issue is being tracked by Cisco Bug ID CSCuv35694

Trust: 2.52

sources: NVD: CVE-2016-1427 // JVNDB: JVNDB-2016-003293 // CNVD: CNVD-2016-04106 // BID: 91262 // VULHUB: VHN-90246

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2016-04106

AFFECTED PRODUCTS

vendor:ciscomodel:prime network registrarscope:eqversion:8.2.1.1

Trust: 1.6

vendor:ciscomodel:prime network registrarscope:eqversion:8.2.3

Trust: 1.6

vendor:ciscomodel:prime network registrarscope:eqversion:8.2.0.2

Trust: 1.6

vendor:ciscomodel:prime network registrarscope:eqversion:8.2.0.1

Trust: 1.6

vendor:ciscomodel:prime network registrarscope:eqversion:8.3.0

Trust: 1.6

vendor:ciscomodel:prime network registrarscope:eqversion:8.3.1

Trust: 1.6

vendor:ciscomodel:prime network registrarscope:eqversion:8.2.2.1

Trust: 1.6

vendor:ciscomodel:prime network registrarscope:eqversion:8.2.0

Trust: 1.6

vendor:ciscomodel:prime network registrarscope:eqversion:8.2.2

Trust: 1.6

vendor:ciscomodel:prime network registrarscope:eqversion:8.2.1

Trust: 1.6

vendor:ciscomodel:prime network registrarscope:eqversion:8.3.2

Trust: 0.8

vendor:ciscomodel:prime network registrarscope:eqversion:8.2.3.1

Trust: 0.8

vendor:ciscomodel:prime network registrarscope:ltversion:8.2

Trust: 0.8

vendor:ciscomodel:prime network registrarscope:ltversion:8.3

Trust: 0.8

vendor:ciscomodel:prime network registrarscope:gtversion:8.3<8.3.2>8.2<8.2.3.1

Trust: 0.6

vendor:ciscomodel:prime network registrarscope:gtversion:8.2<8.2.3.1

Trust: 0.6

sources: CNVD: CNVD-2016-04106 // JVNDB: JVNDB-2016-003293 // NVD: CVE-2016-1427 // CNNVD: CNNVD-201606-427

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD: CVE-2016-1427
value: HIGH

Trust: 1.8

CNVD: CNVD-2016-04106
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201606-427
value: MEDIUM

Trust: 0.6

VULHUB: VHN-90246
value: MEDIUM

Trust: 0.1

NVD:
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: FALSE
obtainAllPrivilege: FALSE
obtainUserPrivilege: FALSE
obtainOtherPrivilege: FALSE
userInteractionRequired: FALSE
version: 2.0

Trust: 1.0

NVD: CVE-2016-1427
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

CNVD: CNVD-2016-04106
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-90246
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

NVD:
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.0

Trust: 1.0

NVD: CVE-2016-1427
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2016-04106 // VULHUB: VHN-90246 // JVNDB: JVNDB-2016-003293 // NVD: CVE-2016-1427 // CNNVD: CNNVD-201606-427

PROBLEMTYPE DATA

problemtype:CWE-200

Trust: 1.9

problemtype:CWE-287

Trust: 1.9

sources: VULHUB: VHN-90246 // JVNDB: JVNDB-2016-003293 // NVD: CVE-2016-1427

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201606-427

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-201606-427

CONFIGURATIONS

sources:
            
            
            NVD: CVE-2016-1427

PATCH
title:cisco-sa-20160616-pnrurl:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20160616-pnr
Trust: 0.8
title:Patch for Cisco PrimeNetworkRegistrar Information Disclosure Vulnerabilityurl:https://www.cnvd.org.cn/patchinfo/show/77754
Trust: 0.6
title:Cisco Prime Network Registrar Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=62356
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2016-04106 // 
            
            
            
            JVNDB: JVNDB-2016-003293 // 
            
            
            
            CNNVD: CNNVD-201606-427

EXTERNAL IDS
db:NVDid:CVE-2016-1427
Trust: 3.4
db:SECTRACKid:1036128
Trust: 1.1
db:JVNDBid:JVNDB-2016-003293
Trust: 0.8
db:CNNVDid:CNNVD-201606-427
Trust: 0.7
db:CNVDid:CNVD-2016-04106
Trust: 0.6
db:AUSCERTid:ESB-2016.1540
Trust: 0.6
db:BIDid:91262
Trust: 0.3
db:VULHUBid:VHN-90246
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2016-04106 // 
            
            
            
            VULHUB: VHN-90246 // 
            
            
            
            BID: 91262 // 
            
            
            
            JVNDB: JVNDB-2016-003293 // 
            
            
            
            NVD: CVE-2016-1427 // 
            
            
            
            CNNVD: CNNVD-201606-427

REFERENCES
url:http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20160616-pnr
Trust: 1.7
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-1427
Trust: 1.4
url:http://www.securitytracker.com/id/1036128
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-1427
Trust: 0.8
url:http://www.auscert.org.au/./render.html?it=35958
Trust: 0.6
url:http://www.cisco.com/
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2016-04106 // 
            
            
            
            VULHUB: VHN-90246 // 
            
            
            
            BID: 91262 // 
            
            
            
            JVNDB: JVNDB-2016-003293 // 
            
            
            
            NVD: CVE-2016-1427 // 
            
            
            
            CNNVD: CNNVD-201606-427

CREDITS
Cisco
Trust: 0.3
sources:
            
            
            BID: 91262

SOURCES
db:CNVDid:CNVD-2016-04106
db:VULHUBid:VHN-90246
db:BIDid:91262
db:JVNDBid:JVNDB-2016-003293
db:NVDid:CVE-2016-1427
db:CNNVDid:CNNVD-201606-427

LAST UPDATE DATE
2023-12-18T13:57:33.204000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2016-04106date:2016-06-20T00:00:00
db:VULHUBid:VHN-90246date:2016-11-30T00:00:00
db:BIDid:91262date:2016-07-06T15:01:00
db:JVNDBid:JVNDB-2016-003293date:2016-06-21T00:00:00
db:NVDid:CVE-2016-1427date:2016-11-30T03:04:07.007
db:CNNVDid:CNNVD-201606-427date:2016-06-17T00:00:00

SOURCES RELEASE DATE
db:CNVDid:CNVD-2016-04106date:2016-06-20T00:00:00
db:VULHUBid:VHN-90246date:2016-06-18T00:00:00
db:BIDid:91262date:2016-06-16T00:00:00
db:JVNDBid:JVNDB-2016-003293date:2016-06-21T00:00:00
db:NVDid:CVE-2016-1427date:2016-06-18T01:59:00.183
db:CNNVDid:CNNVD-201606-427date:2016-06-17T00:00:00