Is CVE-2016-9012 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-9012 being exploited in the wild.

How severe is CVE-2016-9012?

High severity, with a CVSS score of 8.8, published 23 January 2017.

Which products and versions are affected?

Arista CloudVision Portal (CVP) Before 2016.1.2.1.

Is there a fix for CVE-2016-9012?

A patch was published on 2016-12-01: Approximate patch availability based on advisory timing Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2016-9012 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2016-9012?

Check whether you run Arista Cloudvision Portal. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-9012: Arista CloudVision Portal access control bypass in management plane

CVE-2016-9012 · Severity: high · CVSS 8.8 · Published 2017-01-23

Arista CloudVision Portal, a management platform for network automation and visibility, contains a security flaw that allows logged-in users to access sensitive internal configuration settings. An attacker with basic user credentials could exploit this to gain unauthorized control over the system's management plane. This could lead to full system compromise, data theft, or disruption of network operations.

Technologies: Arista Cloudvision Portal. Vendors: Arista.

Quick answers

Is CVE-2016-9012 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-9012 being exploited in the wild.
How severe is CVE-2016-9012?: High severity, with a CVSS score of 8.8, published 23 January 2017.
Which products and versions are affected?: Arista CloudVision Portal (CVP) Before 2016.1.2.1.
Is there a fix for CVE-2016-9012?: A patch was published on 2016-12-01: Approximate patch availability based on advisory timing Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-9012 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2016-9012?: Check whether you run Arista Cloudvision Portal. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A privilege escalation or improper access control vulnerability exists in Arista CloudVision Portal (CVP) versions prior to 2016.1.2.1. The flaw is located within the management plane and is specifically related to how the system handles requests to the '/web/system/console/bundle' endpoint. A remote attacker with valid low-privileged credentials can send a crafted request to this endpoint to bypass intended access restrictions. Successful exploitation allows the attacker to interact with internal configuration mechanisms, potentially leading to a complete compromise of the CVP instance. The issue is addressed in version 2016.1.2.1 and later.

Affected products

Arista CloudVision Portal (CVP) Before 2016.1.2.1

Timeline

2016-11-30: advisory: SecurityFocus BID 94635 published
2017-01-23: disclosed: NVD publication date
2016-12-01: patched: Approximate patch availability based on advisory timing

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.