PT-2014-5170 · Cisco · Cisco Unified Communications Manager+1

Publicado 2014-05-23 · Atualizado 2016-09-07 · CVE-2014-3274

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco TelePresence System (CTS) versions 6.0(.5)(5) and earlier

Description The issue allows man-in-the-middle attackers to obtain sensitive directory information by leveraging a network position between CTS and Cisco Unified Communications Manager (UCM) to block HTTPS traffic, causing the system to fall back to HTTP when certain HTTPS sessions cannot be established.

Recommendations For Cisco TelePresence System (CTS) versions 6.0(.5)(5) and earlier, consider configuring the system to enforce HTTPS connections and restrict the use of HTTP to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2014-3274

Produtos afetados

Cisco Telepresence System

Cisco Unified Communications Manager

Referências · 4

• http://tools.cisco.com/security/center/viewAlert.x?alertId=34327 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-3274 · Nota de Segurança
• http://securitytracker.com/id/1030272 · Nota
• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3274 · Aviso do Fabricante