Sign-up

ID

VAR-201611-0159


CVE

CVE-2016-6447


TITLE

Cisco Meeting Server and Meeting Vulnerability to execute arbitrary code in application

Trust: 0.8

sources: JVNDB: JVNDB-2016-005731

DESCRIPTION

A vulnerability in Cisco Meeting Server and Meeting App could allow an unauthenticated, remote attacker to execute arbitrary code on an affected system. This vulnerability affects the following products: Cisco Meeting Server releases prior to 2.0.1, Acano Server releases prior to 1.8.16 and prior to 1.9.3, Cisco Meeting App releases prior to 1.9.8, Acano Meeting Apps releases prior to 1.8.35. More Information: CSCva75942 CSCvb67878. Known Affected Releases: 1.81.92.0. Vendors have confirmed this vulnerability Bug ID CSCva75942 and CSCvb67878 It is released as.A third party may execute arbitrary code. This issue being tracked by Cisco Bug ID CSCva75942 and CSCvb67878. Cisco Meeting Server (formerly known as Acano Conferencing Server, CMS) and so on are products of Cisco (Cisco). CMS is a set of conference server software including audio and video; Cisco Meeting App is a set of applications for creating, joining and running conference video systems. A buffer overflow vulnerability exists in several Cisco products

Trust: 2.07

sources: NVD: CVE-2016-6447 // JVNDB: JVNDB-2016-005731 // BID: 94073 // VULHUB: VHN-95267 // VULMON: CVE-2016-6447

AFFECTED PRODUCTS

vendor:ciscomodel:meeting serverscope:eqversion:2.0.0

Trust: 1.6

vendor:ciscomodel:meeting appscope:eqversion:1.8.0

Trust: 1.6

vendor:ciscomodel:meeting serverscope:eqversion:1.9.0

Trust: 1.6

vendor:ciscomodel:meeting serverscope:eqversion:1.8_base

Trust: 1.6

vendor:ciscomodel:meeting appscope:eqversion:1.9.0

Trust: 1.6

vendor:ciscomodel:meeting serverscope:ltversion:(acano server)

Trust: 0.8

vendor:ciscomodel:meeting applicationscope:eqversion:1.8.35

Trust: 0.8

vendor:ciscomodel:meeting applicationscope:ltversion:(acano apps)

Trust: 0.8

vendor:ciscomodel:meeting serverscope:ltversion:1.9.x (acano server)

Trust: 0.8

vendor:ciscomodel:meeting serverscope:eqversion:1.9.3

Trust: 0.8

vendor:ciscomodel:meeting serverscope:eqversion:1.8.16

Trust: 0.8

vendor:ciscomodel:meeting serverscope:eqversion:0

Trust: 0.3

vendor:ciscomodel:meeting appsscope:eqversion:0

Trust: 0.3

vendor:ciscomodel:meeting appscope:eqversion:0

Trust: 0.3

vendor:ciscomodel:acano serverscope:eqversion:1.9

Trust: 0.3

vendor:ciscomodel:acano serverscope:eqversion:1.8

Trust: 0.3

vendor:ciscomodel:meeting serverscope:neversion:2.0.1

Trust: 0.3

vendor:ciscomodel:meeting appsscope:neversion:1.8.35

Trust: 0.3

vendor:ciscomodel:meeting appscope:neversion:1.9.8

Trust: 0.3

vendor:ciscomodel:acano serverscope:neversion:1.9.3

Trust: 0.3

vendor:ciscomodel:acano serverscope:neversion:1.8.16

Trust: 0.3

sources: BID: 94073 // JVNDB: JVNDB-2016-005731 // CNNVD: CNNVD-201611-006 // NVD: CVE-2016-6447

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2016-6447
value: CRITICAL

Trust: 1.0

NVD: CVE-2016-6447
value: CRITICAL

Trust: 0.8

CNNVD: CNNVD-201611-006
value: HIGH

Trust: 0.6

VULHUB: VHN-95267
value: HIGH

Trust: 0.1

VULMON: CVE-2016-6447
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2016-6447
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-95267
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2016-6447
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-95267 // VULMON: CVE-2016-6447 // JVNDB: JVNDB-2016-005731 // CNNVD: CNNVD-201611-006 // NVD: CVE-2016-6447

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.9

sources: VULHUB: VHN-95267 // JVNDB: JVNDB-2016-005731 // NVD: CVE-2016-6447

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201611-006

TYPE

buffer overflow

Trust: 0.6

sources: CNNVD: CNNVD-201611-006

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2016-005731

PATCH
title:cisco-sa-20161102-cmsurl:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161102-cms
Trust: 0.8
title:Multiple Cisco Product Buffer Overflow Vulnerability Fixurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=65236
Trust: 0.6
title:Threatposturl:https://threatpost.com/cisco-patches-critical-bugs-in-900-series-routers-prime-home-server/121765/
Trust: 0.1
sources:
            
            
            VULMON: CVE-2016-6447 // 
            
            
            
            JVNDB: JVNDB-2016-005731 // 
            
            
            
            CNNVD: CNNVD-201611-006

EXTERNAL IDS
db:NVDid:CVE-2016-6447
Trust: 2.9
db:BIDid:94073
Trust: 1.5
db:SECTRACKid:1037180
Trust: 1.2
db:JVNDBid:JVNDB-2016-005731
Trust: 0.8
db:CNNVDid:CNNVD-201611-006
Trust: 0.7
db:VULHUBid:VHN-95267
Trust: 0.1
db:VULMONid:CVE-2016-6447
Trust: 0.1
sources:
            
            
            VULHUB: VHN-95267 // 
            
            
            
            VULMON: CVE-2016-6447 // 
            
            
            
            BID: 94073 // 
            
            
            
            JVNDB: JVNDB-2016-005731 // 
            
            
            
            CNNVD: CNNVD-201611-006 // 
            
            
            
            NVD: CVE-2016-6447

REFERENCES
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20161102-cms
Trust: 2.1
url:http://www.securityfocus.com/bid/94073
Trust: 1.2
url:http://www.securitytracker.com/id/1037180
Trust: 1.2
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-6447
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-6447
Trust: 0.8
url:http://www.cisco.com/
Trust: 0.3
url:https://cwe.mitre.org/data/definitions/119.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://threatpost.com/cisco-patches-critical-bugs-in-900-series-routers-prime-home-server/121765/
Trust: 0.1
sources:
            
            
            VULHUB: VHN-95267 // 
            
            
            
            VULMON: CVE-2016-6447 // 
            
            
            
            BID: 94073 // 
            
            
            
            JVNDB: JVNDB-2016-005731 // 
            
            
            
            CNNVD: CNNVD-201611-006 // 
            
            
            
            NVD: CVE-2016-6447

CREDITS
Cisco
Trust: 0.3
sources:
            
            
            BID: 94073

SOURCES
db:VULHUBid:VHN-95267
db:VULMONid:CVE-2016-6447
db:BIDid:94073
db:JVNDBid:JVNDB-2016-005731
db:CNNVDid:CNNVD-201611-006
db:NVDid:CVE-2016-6447

LAST UPDATE DATE
2025-04-13T23:31:24.351000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-95267date:2017-07-29T00:00:00
db:VULMONid:CVE-2016-6447date:2017-07-29T00:00:00
db:BIDid:94073date:2016-11-24T01:07:00
db:JVNDBid:JVNDB-2016-005731date:2016-11-08T00:00:00
db:CNNVDid:CNNVD-201611-006date:2016-11-04T00:00:00
db:NVDid:CVE-2016-6447date:2025-04-12T10:46:40.837

SOURCES RELEASE DATE
db:VULHUBid:VHN-95267date:2016-11-03T00:00:00
db:VULMONid:CVE-2016-6447date:2016-11-03T00:00:00
db:BIDid:94073date:2016-11-02T00:00:00
db:JVNDBid:JVNDB-2016-005731date:2016-11-08T00:00:00
db:CNNVDid:CNNVD-201611-006date:2016-11-04T00:00:00
db:NVDid:CVE-2016-6447date:2016-11-03T21:59:04.217