CVE-2014-7991
First published: Fri Nov 14 2014(Updated: )
The Remote Mobile Access Subsystem in Cisco Unified Communications Manager (CM) 10.0(1) and earlier does not properly validate the Subject Alternative Name (SAN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof VCS core devices via a crafted certificate issued by a legitimate Certification Authority, aka Bug ID CSCuq86376.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Unified Communications Manager | <=10.0\(1\) | |
| Cisco Unified Communications Manager | =10.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://secunia.com/advisories/62267
- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-7991
- http://tools.cisco.com/security/center/viewAlert.x?alertId=36381
- http://www.securityfocus.com/bid/71013
- http://www.securitytracker.com/id/1031181
- https://exchange.xforce.ibmcloud.com/vulnerabilities/98574
Frequently Asked Questions
What is the severity of CVE-2014-7991?
CVE-2014-7991 has been assigned a high severity rating due to the potential for man-in-the-middle attacks.
How do I fix CVE-2014-7991?
To mitigate CVE-2014-7991, upgrade to a version of Cisco Unified Communications Manager later than 10.0(1) that properly validates the Subject Alternative Name field.
What devices are affected by CVE-2014-7991?
CVE-2014-7991 affects Cisco Unified Communications Manager versions 10.0(1) and earlier.
What impact does CVE-2014-7991 have on system security?
CVE-2014-7991 allows attackers to exploit improper validation in X.509 certificates, potentially leading to unauthorized access and data interception.
Can CVE-2014-7991 be exploited remotely?
Yes, CVE-2014-7991 can be exploited remotely by man-in-the-middle attackers using crafted certificates.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/weakness
- agent/author
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/tags
- agent/source
- vendor/cisco
- canonical/cisco unified communications manager
- version/cisco unified communications manager/10.0\(1\)
- version/cisco unified communications manager/10.0