=====================================================================

                           CERT-Renater

               Note d'Information No. 2014/VULN137
_____________________________________________________________________

DATE                : 03/07/2014

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Cisco Unified CDM Application Software versions
                            prior to 8.1.4, 10,
            Cisco Unified CDM Platform Software versions prior to 4.4.2.

======================================================================
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140702-cucdm
______________________________________________________________________

Multiple Vulnerabilities in Cisco Unified Communications Domain Manager

Advisory ID: cisco-sa-20140702-cucdm

Revision 1.0

For Public Release 2014 July 2 16:00  UTC (GMT)

+---------------------------------------------------------------------

Summary
=======

Cisco Unified Communications Domain Manager (Cisco Unified CDM) is
affected by the following vulnerabilities:


    Cisco Unified Communications Domain Manager Privilege Escalation
Vulnerability
    Cisco Unified Communications Domain Manager Default SSH Key
Vulnerability
    Cisco Unified Communications Domain Manager BVSMWeb Unauthorized
Data Manipulation Vulnerability


Successful exploitation of the Cisco Unified Communications Domain
Manager Privilege Escalation Vulnerability or of the Cisco Unified
Communications Domain Manager Default SSH Key Vulnerability may allow
an attacker to execute arbitrary commands or obtain privileged access
to the affected system.

Successful exploitation of the Cisco Unified Communications Domain
Manager BVSMWeb Unauthorized Data Manipulation Vulnerability may allow
an attacker to access and modify BVSMWeb portal user information such
settings in the personal phone directory, speed dials, Single Number
Reach, and call forward settings.

Cisco has released free software updates that address the Cisco Unified
Communications Domain Manager Privilege Escalation Vulnerability and
the Cisco Unified Communications Domain Manager Default SSH Key
Vulnerability.

Cisco will provide a free software update for the Cisco Unified
Communications Domain Manager BVSMWeb Unauthorized Data Manipulation
Vulnerability as soon as the fix is available.

Workarounds that mitigate these vulnerabilities are not available.
Customers that are concerned about the Cisco Unified Communications
Domain Manager BVSMWeb Unauthorized Data Manipulation Vulnerability may
apply the mitigation detailed in the "Workarounds" section of this
advisory.

This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140702-cucdm


=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================