Guest

Preview Tool

Cisco Bug: CSCuq99452 - VOSS: Default Private SSH key Installed on CUCDM

Last Modified

Aug 06, 2018

Products (1)

  • Cisco Hosted Collaboration Solution (HCS)

Known Affected Releases

4.4(2)

Description (partial)

Symptom:
Cisco Unified Communications Domain Manager (Cisco Unified CDM) is affected by the following vulnerabilities:

    Cisco Unified Communications Domain Manager Privilege Escalation Vulnerability
    Cisco Unified Communications Domain Manager Default SSH Key Vulnerability
    Cisco Unified Communications Domain Manager BVSMWeb Unauthorized Data Manipulation Vulnerability

Successful exploitation of the Cisco Unified Communications Domain Manager Privilege Escalation Vulnerability or of the Cisco Unified
Communications Domain Manager Default SSH Key Vulnerability may allow an attacker to execute arbitrary commands or obtain privileged access to
the affected system.
Successful exploitation of the Cisco Unified Communications Domain Manager BVSMWeb Unauthorized Data Manipulation Vulnerability may allow an
attacker to access and modify BVSMWeb portal user information such settings in the personal phone directory, speed dials, Single Number Reach,
and call forward settings.

Cisco has released free software updates that address the Cisco Unified Communications Domain Manager Privilege Escalation Vulnerability and the
Cisco Unified Communications Domain Manager Default SSH Key Vulnerability.
Cisco will provide a free software update for the Cisco Unified Communications Domain Manager BVSMWeb Unauthorized Data Manipulation
Vulnerability as soon as the fix is available.

Workarounds that mitigate these vulnerabilities are not available. Customers that are concerned about the Cisco Unified Communications Domain
Manager BVSMWeb Unauthorized Data Manipulation Vulnerability may apply the mitigation detailed in the ''Workarounds'' section of this advisory.

Note: Due to an error in the fix of the Cisco Unified Communications Domain Manager Default SSH Key Vulnerability, all Cisco Unified CDM Platform
Software releases are vulnerable regardless if a previous patch has been applied due to this security advisory. This advisory has been updated to
provide additional information about the fix for the Cisco Unified Communications Domain Manager Default SSH Key Vulnerability.

Conditions:
See published Cisco Security Advisory
Bug details contain sensitive information and therefore require a Cisco.com account to be viewed.

Bug Details Include

  • Full Description (including symptoms, conditions and workarounds)
  • Status
  • Severity
  • Known Fixed Releases
  • Related Community Discussions
  • Number of Related Support Cases
Bug information is viewable for customers and partners who have a service contract. Registered users can view up to 200 bugs per month without a service contract.