PT-2014-5226 · Cisco · Cisco Unity Connection

Publicado 2014-08-11 · Atualizado 2017-08-29 · CVE-2014-3333

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Unity Connection versions 9.1(1) through 9.1(2)

Description The issue allows remote authenticated users to gain privileged access by conducting an HTTP Intercept attack. This is achieved by leveraging the ability to read files within the context of the web-server user account.

Recommendations For Cisco Unity Connection versions 9.1(1) and 9.1(2), consider restricting access to sensitive files and directories within the web-server user account context until a patch is available. As a temporary workaround, restrict the ability to conduct HTTP Intercept attacks on the server.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2014-3333

Produtos afetados

Cisco Unity Connection

Referências · 7

• http://securitytracker.com/id/1030688 · Nota
• http://tools.cisco.com/security/center/viewAlert.x?alertId=35200 · Aviso do Fabricante
• http://securityfocus.com/bid/69074 · Nota
• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3333 · Aviso do Fabricante
• http://secunia.com/advisories/59768 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95135 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-3333 · Nota de Segurança