CVE-2014-3338: Input Validation
The CTIManager module in Cisco Unified Communications Manager (CM) 10.0(1), when single sign-on is enabled, does not properly validate Kerberos SSO tokens, which allows remote authenticated users to gain privileges and execute arbitrary commands via crafted token data, aka Bug ID CSCum95491.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3338?
CVE-2014-3338 is considered a critical vulnerability due to its potential to allow remote authenticated users to gain elevated privileges.
How do I fix CVE-2014-3338?
To fix CVE-2014-3338, apply the latest security patches provided by Cisco for Unified Communications Manager 10.0(1).
What systems are affected by CVE-2014-3338?
CVE-2014-3338 specifically affects Cisco Unified Communications Manager version 10.0(1) with single sign-on enabled.
What type of attack can CVE-2014-3338 facilitate?
CVE-2014-3338 can facilitate privilege escalation attacks, allowing unauthorized command execution via crafted Kerberos SSO tokens.
Is there a way to mitigate CVE-2014-3338 if I cannot update immediately?
While immediate patching is recommended, consider disabling Kerberos single sign-on until the vulnerability can be remediated.