PT-2016-6918 · Cisco · Cisco Meeting Server+1

Publicado 2016-10-27 · Atualizado 2017-07-30 · CVE-2016-6445

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Cisco Meeting Server versions prior to 2.0.6 Acano Server versions prior to 1.8.18 Acano Server versions 1.9.x prior to 1.9.6

Description The issue arises from the incorrect processing of a deprecated authentication scheme by the Extensible Messaging and Presence Protocol (XMPP) service. This could allow an unauthenticated, remote attacker to masquerade as a legitimate user, potentially gaining access to the system as another user.

Recommendations For Cisco Meeting Server versions prior to 2.0.6, update to version 2.0.6 or later. For Acano Server versions prior to 1.8.18, update to version 1.8.18 or later. For Acano Server versions 1.9.x prior to 1.9.6, update to version 1.9.6 or later.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2016-6445

Produtos afetados

Acano Server

Cisco Meeting Server

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2016-6445 · Nota de Segurança
• http://securitytracker.com/id/1037000 · Nota
• https://osv.dev/vulnerability/CVE-2016-6445 · Aviso do Fabricante
• http://securityfocus.com/bid/93517 · Nota
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161012-msc · Aviso do Fabricante