CVE-2016-6445: Input Validation
First published: Thu Oct 27 2016(Updated: )
A vulnerability in the Extensible Messaging and Presence Protocol (XMPP) service of the Cisco Meeting Server (CMS) before 2.0.6 and Acano Server before 1.8.18 and 1.9.x before 1.9.6 could allow an unauthenticated, remote attacker to masquerade as a legitimate user. This vulnerability is due to the XMPP service incorrectly processing a deprecated authentication scheme. A successful exploit could allow an attacker to access the system as another user.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Meeting Server | =1.8.15 | |
| Cisco Meeting Server | =1.8_base | |
| Cisco Meeting Server | =1.9.0 | |
| Cisco Meeting Server | =1.9.2 | |
| Cisco Meeting Server | =2.0.0 | |
| Cisco Meeting Server | =2.0.1 | |
| Cisco Meeting Server | =2.0.3 | |
| Cisco Meeting Server | =2.0.4 | |
| Cisco Meeting Server | =2.0.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/references
- agent/severity
- agent/weakness
- agent/tags
- agent/event
- agent/first-publish-date
- agent/description
- agent/source
- vendor/cisco
- canonical/cisco meeting server
- version/cisco meeting server/1.8.15
- version/cisco meeting server/1.8_base
- version/cisco meeting server/1.9.0
- version/cisco meeting server/1.9.2
- version/cisco meeting server/2.0.0
- version/cisco meeting server/2.0.1
- version/cisco meeting server/2.0.3
- version/cisco meeting server/2.0.4
- version/cisco meeting server/2.0.5