bugtraq - Cisco Security Advisory: Multiple Vulnerabilities in Cisco Unified Communications Domain Manager

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-id: <201407021806.6.cucdm@psirt.cisco.com>
Date: Wed,  2 Jul 2014 18:06:32 +0200
From: Cisco Systems Product Security Incident Response Team <psirt@...co.com>
To: bugtraq@...urityfocus.com
Cc: psirt@...co.com
Subject: Cisco Security Advisory: Multiple Vulnerabilities in Cisco Unified Communications Domain Manager

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Multiple Vulnerabilities in Cisco Unified Communications Domain Manager

Advisory ID: cisco-sa-20140702-cucdm

Revision 1.0

For Public Release 2014 July 2 16:00  UTC (GMT)

+---------------------------------------------------------------------

Summary
=======

Cisco Unified Communications Domain Manager (Cisco Unified CDM) is affected by the following vulnerabilities:

    Cisco Unified Communications Domain Manager Privilege Escalation Vulnerability
    Cisco Unified Communications Domain Manager Default SSH Key Vulnerability
    Cisco Unified Communications Domain Manager BVSMWeb Unauthorized Data Manipulation Vulnerability

Successful exploitation of the Cisco Unified Communications Domain Manager Privilege Escalation Vulnerability or of the Cisco Unified Communications Domain Manager Default SSH Key Vulnerability may allow an attacker to execute arbitrary commands or obtain privileged access to the affected system.
Successful exploitation of the Cisco Unified Communications Domain Manager BVSMWeb Unauthorized Data Manipulation Vulnerability may allow an attacker to access and modify BVSMWeb portal user information such settings in the personal phone directory, speed dials, Single Number Reach, and call forward settings.

Cisco has released free software updates that address the Cisco Unified Communications Domain Manager Privilege Escalation Vulnerability and the Cisco Unified Communications Domain Manager Default SSH Key Vulnerability.
Cisco will provide a free software update for the Cisco Unified Communications Domain Manager BVSMWeb Unauthorized Data Manipulation Vulnerability as soon as the fix is available.

Workarounds that mitigate these vulnerabilities are not available. Customers that are concerned about the Cisco Unified Communications Domain Manager BVSMWeb Unauthorized Data Manipulation Vulnerability may apply the mitigation detailed in the "Workarounds" section of this advisory.
This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140702-cucdm

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (SunOS)

iQIVAwUBU7QbV4pI1I6i1Mx3AQKVLA//TEKNdo/FP3h8CtJlMenXH3tzM1xh0zM/
1XzSxz24NOJ/B4SHzOwz8oWrzYx73CiZDgxmuZfMkssWjYH2nUTXU893XEgownMa
z/OIvp0UIR0A+PNEAFFwukkD+2yDz/z6M/pZnVOsvazKihtQ/RodQYB5ffNzTiqM
sgFvIq0410GWRdPb/GnewWZ97mPvZhAuHN+J50b8Q+is47r9amEDJxT0ATj7Iuvi
OM5QJxogYzDj6Z8b+FTEVOglza32azmrWBCWU/pq8UJ4gtaqQGnDjwNWTmUtsPfI
qL1G66nBRjzE/avdd9PnqOhJjxWQkeMcHPL5R5g2G+5YLvnmEJDHPYC/oCYy3rsa
CblYHFQP1sTW8apYvrM7xC/ZSKF9Cpn3PwaUaMis7tXqX/d3VJt8YuIkCYnJX7mw
/ZPMUurbKrnjYUsrVlbSVPTiCrg+U1fkZnHrY+akp7gpj6Ay1jFcKKMQ8EnAwhlz
NS3clKLFCOmV3ov96SBwsHXA7XQDRQG5bOcXaD12hWsWbLV2hHwXYCb/m0f/XKxE
opdMXmFwn8oOJJBgFLe9DTR9rhm7P06sdrXS82bPglQCod3gdsIW3Zz+O+ekMrCh
E+WGiiBatkZ0WIjvse6QaEAexZMzizWC0ATsFWylAMT/nd4ZXTNYAFV0KJyavZq1
RFrcvzPuQKk=
=B+Fk
-----END PGP SIGNATURE-----