PT-2014-8363 · Cisco · Cisco Unified Communications Manager

Publicado 2014-11-14 · Atualizado 2017-09-08 · CVE-2014-7991

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager versions prior to 10.0(1)

Description The issue is related to the Remote Mobile Access Subsystem, which does not properly validate the Subject Alternative Name field of an X.509 certificate. This allows man-in-the-middle attackers to spoof VCS core devices via a crafted certificate issued by a legitimate Certification Authority.

Recommendations For versions prior to 10.0(1), update to a version that properly validates the Subject Alternative Name field of X.509 certificates to prevent man-in-the-middle attacks.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2014-7991

Produtos afetados

Cisco Unified Communications Manager

Referências · 7

• http://securityfocus.com/bid/71013 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-7991 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/98574 · Nota
• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-7991 · Aviso do Fabricante
• http://tools.cisco.com/security/center/viewAlert.x?alertId=36381 · Aviso do Fabricante
• http://securitytracker.com/id/1031181 · Nota
• http://secunia.com/advisories/62267 · Nota