PT-2010-5410 · Cisco+1 · Cisco Unified Videoconferencing (Uvc) System+1

Publicado 2010-11-22 · Atualizado 2010-11-30 · CVE-2010-4302

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Média

Vetor base

AV:L/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Unified Videoconferencing (UVC) System versions 5110 and 5115

Description The issue concerns the use of a weak hashing algorithm for administrator and operator passwords in the Cisco Unified Videoconferencing (UVC) System when the Linux operating system is used. This weakness makes it easier for local users to obtain sensitive information by recovering the cleartext values of the passwords.

Recommendations For Cisco Unified Videoconferencing (UVC) System versions 5110 and 5115, consider changing the administrator and operator passwords to strong, unique values and avoid using the Mcu.val file for password storage until a stronger hashing algorithm is implemented. As a temporary workaround, restrict local access to the system to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2010-4302

Produtos afetados

Cisco Unified Videoconferencing (Uvc) System

Linux

Referências · 4

• http://trustmatta.com/advisories/MATTA-2010-001.txt · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-4302 · Nota de Segurança
• http://cisco.com/en/US/products/products_security_response09186a0080b56d0d.html · Aviso do Fabricante
• http://seclists.org/fulldisclosure/2010/Nov/167 · Nota