Cisco Security Advisory: Multiple Vulnerabilities in Cisco Unified Communications Domain Manager

[Cisco Systems Product Security Incident Response Team <psirt@xxxxxxxxx>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Multiple Vulnerabilities in Cisco Unified Communications Domain Manager

Advisory ID: cisco-sa-20140702-cucdm

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140702-cucdm

Revision 3.0

Last Updated  2014 October 13 15:55  UTC (GMT)

For Public Release 2014 July 2 16:00  UTC (GMT)

Summary
+======

Cisco Unified Communications Domain Manager (Cisco Unified CDM) is affected by 
the following vulnerabilities:
  Cisco Unified Communications Domain Manager Privilege Escalation Vulnerability
  Cisco Unified Communications Domain Manager Default SSH Key Vulnerability
  Cisco Unified Communications Domain Manager BVSMWeb Unauthorized Data 
Manipulation Vulnerability

Successful exploitation of the Cisco Unified Communications Domain Manager 
Privilege Escalation Vulnerability or of the Cisco Unified Communications 
Domain Manager Default SSH Key Vulnerability may allow an attacker to execute 
arbitrary commands or obtain privileged access to the affected system.

Successful exploitation of the Cisco Unified Communications Domain Manager 
BVSMWeb Unauthorized Data Manipulation Vulnerability may allow an attacker to 
access and modify BVSMWeb portal user information such settings in the personal 
phone directory, speed dials, Single Number Reach, and call forward settings.

Cisco has released free software updates that address the Cisco Unified 
Communications Domain Manager Privilege Escalation Vulnerability and the Cisco 
Unified Communications Domain Manager Default SSH Key Vulnerability. 
Cisco will provide a free software update for the Cisco Unified Communications 
Domain Manager BVSMWeb Unauthorized Data Manipulation Vulnerability as soon as 
the fix is available.

Workarounds that mitigate these vulnerabilities are not available. Customers 
that are concerned about the Cisco Unified Communications Domain Manager 
BVSMWeb Unauthorized Data Manipulation Vulnerability may apply the mitigation 
detailed in the "Workarounds" section of this advisory. 

Note: Due to an error in the fix of the Cisco Unified Communications Domain 
Manager Default SSH Key Vulnerability, all Cisco Unified CDM Platform Software 
releases are vulnerable regardless if a previous patch has been applied due to 
this security advisory. This advisory has been updated to provide additional 
information about the fix for the Cisco Unified Communications Domain Manager 
Default SSH Key Vulnerability.


This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140702-cucdm
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.22 (Darwin)
Comment: GPGTools - http://gpgtools.org

iQIcBAEBAgAGBQJUO/juAAoJEIpI1I6i1Mx3r94QAJBMpMTdBAtRk7bWRKrQDkaZ
227h5iHky4H693SJuyGYs4Of1lo1ZUlPkF87DgfitoxbPrWZ2LNYSnlfATxigoJZ
Jg1QEeDCwaNGrXCCuCUaZ/yAxYfBh3LvV7AipRSWdAzy8xgmAaMw31uJ0Ww5rxQr
SfS8dxAve0LkJm0cd2BGdKEfVJ/GX9yhKIbs5ZWqKrFsqbqrRF87RFostSGQiVkS
9P9lHdfq43F3OL+j6ngjN9ZpV8lk43BUZXJH9rZXWMbN9MoQ3VsSS/H03DVpvS6D
fWvsq0A7Ut+dh/YmyLCE0sT+kf7gTn50SirNX82zbzI9qGB+8SPc+SVUfbJvazCV
FNcGvl6+KetmG+FQYSzUnP/MZ3xRUUo2M01u92QRWOJDd4qNJ02yaaPkfuCyRH9q
/ZSIALEXWgINOxIuW8ZdiRHDqrkUtmTCMXXmCCLSq7oEwC1AcBrsPNzzlTEagItj
GnHjR0UqsIkbzFeTgP7Z9dRfovM/PQnPGiapslcDowre8VLIXrj/WNlAyN5jvcx8
xQoXLpnGnts0B7Jsf1mjnmq8A+JCk1C4ry8V04FiaVeA0HRU1baRw8MiNcHNKtUa
MuS4XsRjMQEj8RYxS0yl8uCW22A3QDmPTKgm2S1gJdR2FrUGY3yHqKdFBs9UKqk7
J8NDxpS3nK42VOz9oYNT
=vtSq
-----END PGP SIGNATURE-----