Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2014.1079.2
Multiple Vulnerabilities in Cisco Unified Communications Domain Manager
16 October 2014
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Cisco Unified Communications Domain Manager
Publisher: Cisco Systems
Operating System: VMware ESX Server
Cisco
Impact/Access: Root Compromise -- Remote/Unauthenticated
Modify Arbitrary Files -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2014-3300 CVE-2014-2198 CVE-2014-2197
Original Bulletin:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140702-cucdm
Revision History: October 16 2014: Added important information regarding fixed versions of the Cisco Unified Communications Domain Manager Default SSH Key Vulnerability
July 3 2014: Initial Release
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Multiple Vulnerabilities in Cisco Unified Communications Domain Manager
Advisory ID: cisco-sa-20140702-cucdm
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140702-cucdm
Revision 3.0
Last Updated 2014 October 13 15:55 UTC (GMT)
For Public Release 2014 July 2 16:00 UTC (GMT)
Summary
+======
Cisco Unified Communications Domain Manager (Cisco Unified CDM) is affected by the following vulnerabilities:
Cisco Unified Communications Domain Manager Privilege Escalation Vulnerability
Cisco Unified Communications Domain Manager Default SSH Key Vulnerability
Cisco Unified Communications Domain Manager BVSMWeb Unauthorized Data Manipulation Vulnerability
Successful exploitation of the Cisco Unified Communications Domain Manager Privilege Escalation Vulnerability or of the Cisco Unified Communications Domain Manager Default SSH Key Vulnerability may allow an attacker to execute arbitrary commands or obtain privileged access to the affected system.
Successful exploitation of the Cisco Unified Communications Domain Manager BVSMWeb Unauthorized Data Manipulation Vulnerability may allow an attacker to access and modify BVSMWeb portal user information such settings in the personal phone directory, speed dials, Single Number Reach, and call forward settings.
Cisco has released free software updates that address the Cisco Unified Communications Domain Manager Privilege Escalation Vulnerability and the Cisco Unified Communications Domain Manager Default SSH Key Vulnerability.
Cisco will provide a free software update for the Cisco Unified Communications Domain Manager BVSMWeb Unauthorized Data Manipulation Vulnerability as soon as the fix is available.
Workarounds that mitigate these vulnerabilities are not available. Customers that are concerned about the Cisco Unified Communications Domain Manager BVSMWeb Unauthorized Data Manipulation Vulnerability may apply the mitigation detailed in the "Workarounds" section of this advisory.
Note: Due to an error in the fix of the Cisco Unified Communications Domain Manager Default SSH Key Vulnerability, all Cisco Unified CDM Platform Software releases are vulnerable regardless if a previous patch has been applied due to this security advisory. This advisory has been updated to provide additional information about the fix for the Cisco Unified Communications Domain Manager Default SSH Key Vulnerability.
This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140702-cucdm
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.22 (Darwin)
Comment: GPGTools - http://gpgtools.org
iQIcBAEBAgAGBQJUO/juAAoJEIpI1I6i1Mx3r94QAJBMpMTdBAtRk7bWRKrQDkaZ
227h5iHky4H693SJuyGYs4Of1lo1ZUlPkF87DgfitoxbPrWZ2LNYSnlfATxigoJZ
Jg1QEeDCwaNGrXCCuCUaZ/yAxYfBh3LvV7AipRSWdAzy8xgmAaMw31uJ0Ww5rxQr
SfS8dxAve0LkJm0cd2BGdKEfVJ/GX9yhKIbs5ZWqKrFsqbqrRF87RFostSGQiVkS
9P9lHdfq43F3OL+j6ngjN9ZpV8lk43BUZXJH9rZXWMbN9MoQ3VsSS/H03DVpvS6D
fWvsq0A7Ut+dh/YmyLCE0sT+kf7gTn50SirNX82zbzI9qGB+8SPc+SVUfbJvazCV
FNcGvl6+KetmG+FQYSzUnP/MZ3xRUUo2M01u92QRWOJDd4qNJ02yaaPkfuCyRH9q
/ZSIALEXWgINOxIuW8ZdiRHDqrkUtmTCMXXmCCLSq7oEwC1AcBrsPNzzlTEagItj
GnHjR0UqsIkbzFeTgP7Z9dRfovM/PQnPGiapslcDowre8VLIXrj/WNlAyN5jvcx8
xQoXLpnGnts0B7Jsf1mjnmq8A+JCk1C4ry8V04FiaVeA0HRU1baRw8MiNcHNKtUa
MuS4XsRjMQEj8RYxS0yl8uCW22A3QDmPTKgm2S1gJdR2FrUGY3yHqKdFBs9UKqk7
J8NDxpS3nK42VOz9oYNT
=vtSq
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBVD9AWxLndAQH1ShLAQJg4g/6A3KrqgivVZEnmPBrgLw4VcxWVMvV6yvz
4qLSGyoORG8hsih0Ecn0WsJDSgAY5lVn7n7+pSBIfadJqzOSJ1v3x1570PpzKyZj
qtWxvxV3S9AJqnT1v9l9gzU9Hpv84yeV45m6DDx8RLWU4VE/90s76Txf4IaEh+wC
T0YRwEo1i/j4lcwwaS8QcAYpx+brrqok34kBp0Lr0ndJ/nYSSLefVvAdbB/GXr2t
EdFcz/jLwlnzeDMOdakX2hs+gT9RhXMuq618Ru306QrtyzB8Q+5rt6VKKYl0lncH
qsKgy4WFPqb38mXIR7pS9wy2YJAwahBD6ojFh+Q47iynXHaKt2rdI8XJ7AG+xhbt
TlN80QYpDsaxNYqnIBN2bqv3Cox/qXx0y9Y9IUhnGXkdGnU/rQNHJOSKsXRII/7v
fIFPzMMyn0bbbNMQxSHSTRK7rVTfIkS3Q7NtOdYtqgqU/uEMR+TSPHv2xBwqIbLJ
d2pVVIb2n66y/7pLYErjyY7vWQAPBRmLS3m/Dnf0lyCYYYPxrnzUS50aiyr/t5uS
k047d/RYM1+GbUJhoSbMZna3J6ASmHwr2IQRJ1aNXZQecO8jjrdHV0tsk7Tk6Mfx
Xdy364bJmAe9cKkRRt/tts3vZY33PWfPn1v/LOoLUSBYixwKUx6pH8/bXThcIS80
3qR+iuY54wQ=
=SPLk
-----END PGP SIGNATURE-----