Cisco Security Advisory: Multiple Vulnerabilities in Cisco Unified Communications Domain Manager

[Cisco Systems Product Security Incident Response Team <psirt@xxxxxxxxx>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Multiple Vulnerabilities in Cisco Unified Communications Domain Manager

Advisory ID: cisco-sa-20140702-cucdm

Revision 2.0

Last Updated  2014 July 8 21:14  UTC (GMT)

For Public Release 2014 July 2 16:00  UTC (GMT)

Summary
=======

Cisco Unified Communications Domain Manager (Cisco Unified CDM) is affected by 
the following vulnerabilities:

        Cisco Unified Communications Domain Manager Privilege Escalation 
Vulnerability
        Cisco Unified Communications Domain Manager Default SSH Key 
Vulnerability
        Cisco Unified Communications Domain Manager BVSMWeb Unauthorized Data 
Manipulation Vulnerability

Successful exploitation of the Cisco Unified Communications Domain Manager 
Privilege Escalation Vulnerability or of the Cisco Unified Communications 
Domain Manager Default SSH Key Vulnerability may allow an attacker to execute 
arbitrary commands or obtain privileged access to the affected system.

Successful exploitation of the Cisco Unified Communications Domain Manager 
BVSMWeb Unauthorized Data Manipulation Vulnerability may allow an attacker to 
access and modify BVSMWeb portal user information such settings in the personal 
phone directory, speed dials, Single Number Reach, and call forward settings.

Cisco has released free software updates that address the Cisco Unified 
Communications Domain Manager Privilege Escalation Vulnerability and the Cisco 
Unified Communications Domain Manager Default SSH Key Vulnerability. 
Cisco will provide a free software update for the Cisco Unified Communications 
Domain Manager BVSMWeb Unauthorized Data Manipulation Vulnerability as soon as 
the fix is available.

Workarounds that mitigate these vulnerabilities are not available.
Customers that are concerned about the Cisco Unified Communications Domain 
Manager BVSMWeb Unauthorized Data Manipulation Vulnerability may apply the 
mitigation detailed in the "Workarounds" section of this advisory. 

This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140702-cucdm
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.22 (Darwin)
Comment: GPGTools - http://gpgtools.org

iQIcBAEBAgAGBQJTvIeDAAoJEIpI1I6i1Mx30I0P/1XF/8k9GNDxvbijSpdhGFjv
b0LtB8NhI/k3oYeFJRtkqONhx6wM+1IPui5n0GM331JdIRuFGIql98iM2dNIgfoL
YYWeybJ8cePFQ6Hk4YDyP7arm+Q49q6x7ulRw6f1zF7TEuRElDBKvCpjexkS3aTY
DqklP/jGn7yZzT5eVmXAohcgve4Jbn20bBJBp3kqr9+HOXs3zOMbt/2kuoEWc9lX
OfsmbSqwyJJT3RGs/kN68zdC1BI7VhOMhzcBfvdnoYxVUlcWWzZimoS0Nujlh+0N
eLKlNRl/Xb85jD9m3KCfw4EsZ+oY7aVILOVguHFRV35LObjzp8fz0XqDi3Qesiw7
F/CVG77B1J3lkRpIlBaHnwD1RDgKL4CG7LSeCsyKaYDcJzZGcx3CLzVDYHFWMELo
+LeRnDSRlT0PJPOcdj/UPZic8s0sUfEzEtlrM2xDe0m4y/Z/GXutD9CbbaVguX97
Pk56BennXG4ZdfDV1GLO6fbvHK/Ai59u6HCeJj7A5rop7wFGy4WpLiyYjD/Qa+ks
akNpfIIMgvpMqzpW8WhWOUK+sP8ScTUr7QDcSQKxDrtO9WsKz8ndmRGFIRs0zx5J
CEKgd+qJ9ElEovS4GSWimgNmjMCII4TzmQ+H1lHkcIqkC89DYMJmGNeARkJi6iTU
HKJjjGl59+rt55H53va+
=DVAZ
-----END PGP SIGNATURE-----