The Cisco Unified Communications Domain Manager contains a default private SSH key that could allow an attacker to run arbitrary code on vulnerable installations. The bug is about as serious as they come, giving remote, unauthenticated attackers access to affected machines with the rights of a root user.
The SSH key vulnerability is one of several that Cisco fixed in the UCDM, which is a platform that allows IT departments to control Unified Communications Manager implementations from a central position. In addition to the hardcoded SSH key, Cisco fixed a privilege escalation vulnerability and an unauthorized data manipulation flaw. But the SSH key vulnerability is by far the most serious of the three.
“A vulnerability in the implementation of the framework that allows access to support representatives of the Cisco Unified Communications Domain Manager Platform Software could allow an unauthenticated, remote attacker to connect to the affected system with the privileges of the root user,” the Cisco advisory says.
“The vulnerability is due to the presence of a default SSH private key, which is stored in an insecure way on the system. An attacker could exploit this vulnerability by obtaining the SSH private key. For example, the attacker might reverse engineer the binary file of the operating system. This will allow the attacker to connect by using the support account to the system without requiring any form of authentication. An exploit could allow the attacker to gain access to the system with the privileges of the root user.”
The privilege escalation flaw in the UCDM platform is less serious than the SSH key bug, but still warrants attention from affected customers.
“The vulnerability is due to improper implementation of authentication and authorization controls of the Administration GUI. An attacker could exploit this vulnerability by submitting a crafted URL to change the administrative credentials of a user. The attacker needs to be authenticated to the system or convince a valid user of the Administration GUI to click a malicious link,” Cisco said in its advisory.
The third flaw that Cisco addressed in this patch release could allow an attacker to modify some user information on a Web portal.
“A vulnerability in the web framework of Cisco Unified Communications Domain Manager Application Software could allow an unauthenticated, remote attacker to access and modify BVSMWeb portal user information such as settings in the personal phone directory, speed dials, Single Number Reach, and call forward settings,” Cisco said.
“The vulnerability is due to improper implementation of authentication and authorization controls when accessing some web pages of the BVSMWeb portal. An attacker could exploit this vulnerability by submitting a crafted URL to the affected system.”
Cisco has patched the first two vulnerabilities, but said there isn’t a fix available for the data manipulation flaw yet. Version 10 of the software, which is scheduled to be released in September, doesn’t contain the vulnerable interface.
