CVE-2014-0657: Medium severity Cisco Unified Communications Manager vulnerability
Published Jan 8, 2014
·Updated
The administration portal in Cisco Unified Communications Manager (Unified CM) 9.1(1) and earlier does not properly handle role restrictions, which allows remote authenticated users to bypass role-based access control via multiple visits to a forbidden portal URL, aka Bug ID CSCuj83540.
Affected Software
113 affected components
Cisco Unified Communications Manager<=9.1\(1\)
Cisco Unified Communications Manager=3.3\(5\)
Cisco Unified Communications Manager=3.3\(5\)sr1
Cisco Unified Communications Manager=3.3\(5\)sr2a
Cisco Unified Communications Manager=4.1\(3\)
Cisco Unified Communications Manager=4.1\(3\)sr1
Cisco Unified Communications Manager=4.1\(3\)sr2
Cisco Unified Communications Manager=4.1\(3\)sr3
Cisco Unified Communications Manager=4.1\(3\)sr4
Cisco Unified Communications Manager=4.2
Cisco Unified Communications Manager=4.2.1
Cisco Unified Communications Manager=4.2.2
Cisco Unified Communications Manager=4.2.3
Cisco Unified Communications Manager=4.2.3sr1
Cisco Unified Communications Manager=4.2.3sr2
Cisco Unified Communications Manager=4.2.3sr2b
Cisco Unified Communications Manager=4.3
Cisco Unified Communications Manager=4.3\(1\)
Cisco Unified Communications Manager=5.0
Cisco Unified Communications Manager=5.1
Cisco Unified Communications Manager=5.1\(1\)
Cisco Unified Communications Manager=5.1\(1b\)
Cisco Unified Communications Manager=5.1\(1c\)
Cisco Unified Communications Manager=5.1\(2\)
Cisco Unified Communications Manager=5.1\(2a\)
Cisco Unified Communications Manager=5.1\(2b\)
Cisco Unified Communications Manager=5.1\(3\)
Cisco Unified Communications Manager=5.1\(3a\)
Cisco Unified Communications Manager=5.1\(3c\)
Cisco Unified Communications Manager=5.1\(3d\)
Cisco Unified Communications Manager=5.1\(3e\)
Cisco Unified Communications Manager=5.1.2
Cisco Unified Communications Manager=6.0
Cisco Unified Communications Manager=6.0\(1\)
Cisco Unified Communications Manager=6.0\(1a\)
Cisco Unified Communications Manager=6.0\(1b\)
Cisco Unified Communications Manager=6.1\(1\)
Cisco Unified Communications Manager=6.1\(1a\)
Cisco Unified Communications Manager=6.1\(1b\)
Cisco Unified Communications Manager=6.1\(2\)
Cisco Unified Communications Manager=6.1\(2\)su1
Cisco Unified Communications Manager=6.1\(2\)su1a
Cisco Unified Communications Manager=6.1\(3\)
Cisco Unified Communications Manager=6.1\(3a\)
Cisco Unified Communications Manager=6.1\(3b\)
Cisco Unified Communications Manager=6.1\(3b\)su1
Cisco Unified Communications Manager=6.1\(4\)
Cisco Unified Communications Manager=6.1\(4\)su1
Cisco Unified Communications Manager=6.1\(4a\)
Cisco Unified Communications Manager=6.1\(4a\)su2
Cisco Unified Communications Manager=6.1\(5\)
Cisco Unified Communications Manager=6.1\(5\)su1
Cisco Unified Communications Manager=6.1\(5\)su2
Cisco Unified Communications Manager=6.1\(5\)su3
Cisco Unified Communications Manager=7.0\(1\)su1
Cisco Unified Communications Manager=7.0\(1\)su1a
Cisco Unified Communications Manager=7.0\(2\)
Cisco Unified Communications Manager=7.0\(2a\)
Cisco Unified Communications Manager=7.0\(2a\)su1
Cisco Unified Communications Manager=7.0\(2a\)su2
Cisco Unified Communications Manager=7.1\(2a\)
Cisco Unified Communications Manager=7.1\(2a\)su1
Cisco Unified Communications Manager=7.1\(2b\)
Cisco Unified Communications Manager=7.1\(2b\)su1
Cisco Unified Communications Manager=7.1\(3\)
Cisco Unified Communications Manager=7.1\(3a\)
Cisco Unified Communications Manager=7.1\(3a\)su1
Cisco Unified Communications Manager=7.1\(3a\)su1a
Cisco Unified Communications Manager=7.1\(3b\)
Cisco Unified Communications Manager=7.1\(3b\)su1
Cisco Unified Communications Manager=7.1\(3b\)su2
Cisco Unified Communications Manager=7.1\(5\)
Cisco Unified Communications Manager=7.1\(5\)su1
Cisco Unified Communications Manager=7.1\(5\)su1a
Cisco Unified Communications Manager=7.1\(5a\)
Cisco Unified Communications Manager=7.1\(5b\)
Cisco Unified Communications Manager=7.1\(5b\)su1
Cisco Unified Communications Manager=7.1\(5b\)su1a
Cisco Unified Communications Manager=7.1\(5b\)su2
Cisco Unified Communications Manager=7.1\(5b\)su3
Cisco Unified Communications Manager=7.1\(5b\)su4
Cisco Unified Communications Manager=7.1\(5b\)su5
Cisco Unified Communications Manager=7.1\(5b\)su6
Cisco Unified Communications Manager=8.0
Cisco Unified Communications Manager=8.0\(1\)
Cisco Unified Communications Manager=8.0\(2\)
Cisco Unified Communications Manager=8.0\(2a\)
Cisco Unified Communications Manager=8.0\(2b\)
Cisco Unified Communications Manager=8.0\(2c\)
Cisco Unified Communications Manager=8.0\(2c\)su1
Cisco Unified Communications Manager=8.0\(3\)
Cisco Unified Communications Manager=8.0\(3a\)
Cisco Unified Communications Manager=8.0\(3a\)su1
Cisco Unified Communications Manager=8.0\(3a\)su2
Cisco Unified Communications Manager=8.0\(3a\)su3
Cisco Unified Communications Manager=8.5
Cisco Unified Communications Manager=8.5\(1\)
Cisco Unified Communications Manager=8.5\(1\)su1
Cisco Unified Communications Manager=8.5\(1\)su2
Cisco Unified Communications Manager=8.5\(1\)su3
Cisco Unified Communications Manager=8.5\(1\)su4
Cisco Unified Communications Manager=8.5\(1\)su5
Cisco Unified Communications Manager=8.6
Cisco Unified Communications Manager=8.6\(1\)
Cisco Unified Communications Manager=8.6\(1a\)
Cisco Unified Communications Manager=8.6\(2\)
Cisco Unified Communications Manager=8.6\(2a\)
Cisco Unified Communications Manager=8.6\(2a\)su1
Cisco Unified Communications Manager=8.6\(2a\)su2
Cisco Unified Communications Manager=8.6\(2a\)su3
Cisco Unified Communications Manager=8.6\(3\)
Cisco Unified Communications Manager=8.6\(4\)
Cisco Unified Communications Manager=9.0\(1\)
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cisco Unified Communications Manager (Unified CM)to a version that resolves this vulnerability.Fixed in 9.1(1) and earlier
Event History
Jan 8, 2014
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Data Sourced
via NVD·09:55 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2014-0657?
CVE-2014-0657 has a medium severity rating because it allows remote authenticated users to bypass access controls.
2
How do I fix CVE-2014-0657?
To fix CVE-2014-0657, update your Cisco Unified Communications Manager to a version later than 9.1(1).
3
What software versions are affected by CVE-2014-0657?
CVE-2014-0657 affects Cisco Unified Communications Manager versions 9.1(1) and earlier, as well as certain earlier versions.
4
Can CVE-2014-0657 be exploited remotely?
Yes, CVE-2014-0657 can be exploited remotely by authenticated users who can bypass role restrictions.
5
What is the nature of the vulnerability in CVE-2014-0657?
The vulnerability in CVE-2014-0657 arises from improper handling of role restrictions in the administration portal.