PT-2015-7238 · Cisco · Cisco Telepresence Video Communication Server

Publicado 2015-12-13 · Atualizado 2016-12-07 · CVE-2015-6414

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Video Communication Server (VCS) version X8.6

Description The issue allows local users to defeat cryptographic protection mechanisms by leveraging knowledge of an encryption key from another installation, as the same encryption key is used across different customers' installations.

Recommendations For Cisco TelePresence Video Communication Server (VCS) version X8.6, consider changing the encryption key to a unique value for each installation to prevent exploitation. As a temporary workaround, restrict access to the system to minimize the risk of local users leveraging knowledge of the encryption key.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2015-6414

Produtos afetados

Cisco Telepresence Video Communication Server

Referências · 4

• http://securityfocus.com/bid/79065 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-6414 · Nota de Segurança
• http://securitytracker.com/id/1034429 · Nota
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151210-tvcs · Aviso do Fabricante