SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Cisco Unified Communications Domain Manager Vendors:   Cisco
Cisco Unified Communications Domain Manager Bugs Let Remote Users Access the System and Remote Authenticated Users Gain Elevated Privileges
SecurityTracker Alert ID:  1030515
SecurityTracker URL:  http://securitytracker.com/id/1030515
CVE Reference:   CVE-2014-2197, CVE-2014-2198, CVE-2014-3300   (Links to External Site)
Updated:  Oct 13 2014
Original Entry Date:  Jul 2 2014
Impact:   Disclosure of system information, Execution of arbitrary code via network, Modification of user information, Root access via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  

Description:   Three vulnerabilities were reported in Cisco Unified Communications Domain Manager. A remote user can gain root access on the target system. A remote authenticated user can obtain elevated privileges on the target system. A remote user can access and modify settings.

A remote authenticated user can submit a specially crafted URL to trigger a flaw in the Administration interface and change the administrative credentials of an arbitrary user [CVE-2014-2197]. This can be exploited to gain elevated privileges.

The vendor has assigned bug ID CSCun49862 to this vulnerability. Fatih Ozavci from Sense of Security reported this vulnerability.

The system uses a default SSH private key that is stored in an non-secure manner [CVE-2014-2198]. A remote user can obtain the SSH private key and use the key to login to the target system with root privileges. The key may be obtained, for example, by reverse engineering the binary file of the operating system.

The vendor has assigned bug ID CSCud41130 to this vulnerability.

A remote user can submit a specially crafted URL to access and modify BVSMWeb portal user information (e.g., personal phone directory settings, speed dials, Single Number Reach, call forward settings) [CVE-2014-3300]. Fatih Ozavci from Sense of Security reported this vulnerability.

The vendor has assigned bug ID CSCum77041 to this vulnerability.

Impact:   A remote user can gain root access on the target system.

A remote authenticated user can obtain administrative privileges on the target system.

A remote user can access and modify settings (e.g., personal phone directory settings, speed dials, Single Number Reach, call forward settings).

Solution:   The vendor has issued a fix for CVE-2014-2197 (Cisco Unified CDM Application Software 8.1.4) and CVE-2014-2198 (Cisco Unified CDM Platform hotfix patch called "ssh_keys_cleanup").

The vendor notes that there was an error in the fix for CVE-2014-2198 and all Cisco Unified CDM Platform Software releases are vulnerable even if a previous security patch from this advisory was been applied.

No solution was available for CVE-2014-3300. However, Cisco Unified CDM Application Software version 10 will remove the vulnerable BVSMWeb service interface [release planned for September 2014.]

The vendor's advisory is available at:

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140702-cucdm

Vendor URL:  tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140702-cucdm (Links to External Site)
Cause:   Access control error, Configuration error

Message History:   None.


 Source Message Contents

Subject:  Cisco Security Advisory: Multiple Vulnerabilities in Cisco Unified Communications Domain Manager

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Multiple Vulnerabilities in Cisco Unified Communications Domain Manager

Advisory ID: cisco-sa-20140702-cucdm

Revision 1.0

For Public Release 2014 July 2 16:00  UTC (GMT)

+---------------------------------------------------------------------

Summary
=======

Cisco Unified Communications Domain Manager (Cisco Unified CDM) is affected by the following vulnerabilities:

    Cisco Unified Communications Domain Manager Privilege Escalation Vulnerability
    Cisco Unified Communications Domain Manager Default SSH Key Vulnerability
    Cisco Unified Communications Domain Manager BVSMWeb Unauthorized Data Manipulation Vulnerability

Successful exploitation of the Cisco Unified Communications Domain Manager Privilege Escalation Vulnerability or of the Cisco Unified Communications Domain Manager Default SSH Key Vulnerability may allow an attacker to execute arbitrary commands or obtain privileged access to the affected system.
Successful exploitation of the Cisco Unified Communications Domain Manager BVSMWeb Unauthorized Data Manipulation Vulnerability may allow an attacker to access and modify BVSMWeb portal user information such settings in the personal phone directory, speed dials, Single Number Reach, and call forward settings.

Cisco has released free software updates that address the Cisco Unified Communications Domain Manager Privilege Escalation Vulnerability and the Cisco Unified Communications Domain Manager Default SSH Key Vulnerability.
Cisco will provide a free software update for the Cisco Unified Communications Domain Manager BVSMWeb Unauthorized Data Manipulation Vulnerability as soon as the fix is available.

Workarounds that mitigate these vulnerabilities are not available. Customers that are concerned about the Cisco Unified Communications Domain Manager BVSMWeb Unauthorized Data Manipulation Vulnerability may apply the mitigation detailed in the "Workarounds" section of this advisory.
This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140702-cucdm


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (SunOS)

iQIVAwUBU7QbV4pI1I6i1Mx3AQKVLA//TEKNdo/FP3h8CtJlMenXH3tzM1xh0zM/
1XzSxz24NOJ/B4SHzOwz8oWrzYx73CiZDgxmuZfMkssWjYH2nUTXU893XEgownMa
z/OIvp0UIR0A+PNEAFFwukkD+2yDz/z6M/pZnVOsvazKihtQ/RodQYB5ffNzTiqM
sgFvIq0410GWRdPb/GnewWZ97mPvZhAuHN+J50b8Q+is47r9amEDJxT0ATj7Iuvi
OM5QJxogYzDj6Z8b+FTEVOglza32azmrWBCWU/pq8UJ4gtaqQGnDjwNWTmUtsPfI
qL1G66nBRjzE/avdd9PnqOhJjxWQkeMcHPL5R5g2G+5YLvnmEJDHPYC/oCYy3rsa
CblYHFQP1sTW8apYvrM7xC/ZSKF9Cpn3PwaUaMis7tXqX/d3VJt8YuIkCYnJX7mw
/ZPMUurbKrnjYUsrVlbSVPTiCrg+U1fkZnHrY+akp7gpj6Ay1jFcKKMQ8EnAwhlz
NS3clKLFCOmV3ov96SBwsHXA7XQDRQG5bOcXaD12hWsWbLV2hHwXYCb/m0f/XKxE
opdMXmFwn8oOJJBgFLe9DTR9rhm7P06sdrXS82bPglQCod3gdsIW3Zz+O+ekMrCh
E+WGiiBatkZ0WIjvse6QaEAexZMzizWC0ATsFWylAMT/nd4ZXTNYAFV0KJyavZq1
RFrcvzPuQKk=
=B+Fk
-----END PGP SIGNATURE-----
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC