PT-2014-5226 · Cisco · Cisco Unity Connection

Published 2014-08-11 · Updated 2017-08-29 · CVE-2014-3333

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Unity Connection versions 9.1(1) through 9.1(2)

Description The issue allows remote authenticated users to gain privileged access by conducting an HTTP Intercept attack. This is achieved by leveraging the ability to read files within the context of the web-server user account.

Recommendations For Cisco Unity Connection versions 9.1(1) and 9.1(2), consider restricting access to sensitive files and directories within the web-server user account context until a patch is available. As a temporary workaround, restrict the ability to conduct HTTP Intercept attacks on the server.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-3333

Affected Products

Cisco Unity Connection

References · 7

• http://tools.cisco.com/security/center/viewAlert.x?alertId=35200 · Vendor Advisory
• http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3333 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-3333 · Security Note
• http://securitytracker.com/id/1030688 · Note
• http://securityfocus.com/bid/69074 · Note
• http://secunia.com/advisories/59768 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95135 · Note