var-201802-0593
Vulnerability from variot

A vulnerability in Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to bypass security protections, gain elevated privileges, and execute arbitrary code. The vulnerability is due to insecure key generation during application configuration. An attacker could exploit this vulnerability by using a known insecure key value to bypass security protections by sending arbitrary requests using the insecure key to a targeted application. An exploit could allow the attacker to execute arbitrary code. This vulnerability affects Cisco Unified Communications Domain Manager releases prior to 11.5(2). Cisco Bug IDs: CSCuv67964. Vendors have confirmed this vulnerability Bug ID CSCuv67964 It is released as.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Failed exploit attempts will result in a denial-of-service condition. This component features scalable, distributed, and highly available enterprise Voice over IP call processing

Show details on source website

To clipboard 

{
  "affected_products": {
    "_id": null,
    "data": [
      {
        "_id": null,
        "model": "unified communications domain manager",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "11.5\\(2\\)"
      },
      {
        "_id": null,
        "model": "unified communications domain manager",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "cisco",
        "version": "8.6"
      },
      {
        "_id": null,
        "model": "unified communications domain manager",
        "scope": "eq",
        "trust": 0.9,
        "vendor": "cisco",
        "version": "10.6.1"
      },
      {
        "_id": null,
        "model": "unified communications domain manager",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "cisco",
        "version": "11.5(2)"
      },
      {
        "_id": null,
        "model": "unified communications domain manager",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "cisco",
        "version": "9.0"
      },
      {
        "_id": null,
        "model": "unified communications domain manager",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "cisco",
        "version": "10.5\\(1.98991.13\\)"
      },
      {
        "_id": null,
        "model": "unified communications domain manager",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "cisco",
        "version": "8.6\\(.2\\)"
      },
      {
        "_id": null,
        "model": "unified communications domain manager",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "cisco",
        "version": "10.6_base"
      },
      {
        "_id": null,
        "model": "unified communications domain manager",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "cisco",
        "version": null
      },
      {
        "_id": null,
        "model": "unified communications domain manager",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "cisco",
        "version": "10.0"
      },
      {
        "_id": null,
        "model": "unified communications domain manager",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "cisco",
        "version": "8.1.4er1"
      },
      {
        "_id": null,
        "model": "unified communications domain manager",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "cisco",
        "version": "9.0\\(.1\\)"
      },
      {
        "_id": null,
        "model": "unified communications domain manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "10.1.2"
      },
      {
        "_id": null,
        "model": "unified communications domain manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "8.1.4"
      },
      {
        "_id": null,
        "model": "unified communications domain manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "8.1.3"
      },
      {
        "_id": null,
        "model": "unified communications domain manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "8.1.2"
      },
      {
        "_id": null,
        "model": "unified communications domain manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "8.1.1"
      },
      {
        "_id": null,
        "model": "unified communications domain manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "6.8.8"
      },
      {
        "_id": null,
        "model": "unified communications domain manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "4.4.3"
      },
      {
        "_id": null,
        "model": "unified communications domain manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "4.4.2"
      },
      {
        "_id": null,
        "model": "unified communications domain manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "8.1(1)"
      },
      {
        "_id": null,
        "model": "unified communications domain manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "8.1(.4)"
      },
      {
        "_id": null,
        "model": "unified communications domain manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "8.1(.3)"
      },
      {
        "_id": null,
        "model": "unified communications domain manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "8.1(.2)"
      },
      {
        "_id": null,
        "model": "unified communications domain manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "8.1(.1)"
      },
      {
        "_id": null,
        "model": "unified communications domain manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "8.1"
      },
      {
        "_id": null,
        "model": "unified communications domain manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "8.0"
      },
      {
        "_id": null,
        "model": "unified communications domain manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "7.4"
      },
      {
        "_id": null,
        "model": "unified communications domain manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "4.4.1"
      },
      {
        "_id": null,
        "model": "unified communications domain manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "10.6(1)"
      },
      {
        "_id": null,
        "model": "unified communications domain manager",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "10.1"
      },
      {
        "_id": null,
        "model": "hosted collaboration solution",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "10.6(2)"
      },
      {
        "_id": null,
        "model": "unified communications domain manager",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "cisco",
        "version": "11.5(2)"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "103114"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-002414"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201802-441"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-0124"
      }
    ]
  },
  "configurations": {
    "_id": null,
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:cisco:unified_communications_domain_manager",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-002414"
      }
    ]
  },
  "credits": {
    "_id": null,
    "data": "Cisco",
    "sources": [
      {
        "db": "BID",
        "id": "103114"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2018-0124",
  "cvss": {
    "_id": null,
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "CVE-2018-0124",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "HIGH",
            "trust": 1.9,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "VHN-118326",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 3.9,
            "id": "CVE-2018-0124",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.8,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2018-0124",
            "trust": 1.0,
            "value": "CRITICAL"
          },
          {
            "author": "NVD",
            "id": "CVE-2018-0124",
            "trust": 0.8,
            "value": "Critical"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201802-441",
            "trust": 0.6,
            "value": "CRITICAL"
          },
          {
            "author": "VULHUB",
            "id": "VHN-118326",
            "trust": 0.1,
            "value": "HIGH"
          },
          {
            "author": "VULMON",
            "id": "CVE-2018-0124",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-118326"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-0124"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-002414"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201802-441"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-0124"
      }
    ]
  },
  "description": {
    "_id": null,
    "data": "A vulnerability in Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to bypass security protections, gain elevated privileges, and execute arbitrary code. The vulnerability is due to insecure key generation during application configuration. An attacker could exploit this vulnerability by using a known insecure key value to bypass security protections by sending arbitrary requests using the insecure key to a targeted application. An exploit could allow the attacker to execute arbitrary code. This vulnerability affects Cisco Unified Communications Domain Manager releases prior to 11.5(2). Cisco Bug IDs: CSCuv67964. Vendors have confirmed this vulnerability Bug ID CSCuv67964 It is released as.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Failed exploit attempts will result in a denial-of-service  condition. This component features scalable, distributed, and highly available enterprise Voice over IP call processing",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2018-0124"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-002414"
      },
      {
        "db": "BID",
        "id": "103114"
      },
      {
        "db": "VULHUB",
        "id": "VHN-118326"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-0124"
      }
    ],
    "trust": 2.07
  },
  "external_ids": {
    "_id": null,
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2018-0124",
        "trust": 2.9
      },
      {
        "db": "BID",
        "id": "103114",
        "trust": 2.1
      },
      {
        "db": "SECTRACK",
        "id": "1040405",
        "trust": 1.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-002414",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201802-441",
        "trust": 0.7
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2019.0544",
        "trust": 0.6
      },
      {
        "db": "VULHUB",
        "id": "VHN-118326",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-0124",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-118326"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-0124"
      },
      {
        "db": "BID",
        "id": "103114"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-002414"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201802-441"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-0124"
      }
    ]
  },
  "id": "VAR-201802-0593",
  "iot": {
    "_id": null,
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-118326"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2024-11-23T20:04:27.334000Z",
  "patch": {
    "_id": null,
    "data": [
      {
        "title": "cisco-sa-20180221-ucdm",
        "trust": 0.8,
        "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-ucdm"
      },
      {
        "title": "Cisco Unified Communications Domain Manager Security vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=78520"
      },
      {
        "title": "Cisco: Cisco Unified Communications Domain Manager Remote Code Execution Vulnerability",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts\u0026qid=cisco-sa-20180221-ucdm"
      },
      {
        "title": "IBM: IBM Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to multiple security vulnerabilities",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=55ea315dfb69fce8383762ac64250315"
      },
      {
        "title": "bot-cisco-vulnerability",
        "trust": 0.1,
        "url": "https://github.com/joagonzalez/bot-cisco-vulnerability "
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2018-0124"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-002414"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201802-441"
      }
    ]
  },
  "problemtype_data": {
    "_id": null,
    "data": [
      {
        "problemtype": "CWE-320",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-118326"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-002414"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-0124"
      }
    ]
  },
  "references": {
    "_id": null,
    "data": [
      {
        "trust": 2.2,
        "url": "https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20180221-ucdm"
      },
      {
        "trust": 1.9,
        "url": "http://www.securityfocus.com/bid/103114"
      },
      {
        "trust": 1.8,
        "url": "http://www.securitytracker.com/id/1040405"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-0124"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-0124"
      },
      {
        "trust": 0.6,
        "url": "http://www.ibm.com/support/docview.wss?uid=ibm10872142"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/75922"
      },
      {
        "trust": 0.6,
        "url": "https://www-01.ibm.com/support/docview.wss?uid=ibm10872142"
      },
      {
        "trust": 0.3,
        "url": "http://www.cisco.com/"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/320.html"
      },
      {
        "trust": 0.1,
        "url": "https://github.com/joagonzalez/bot-cisco-vulnerability"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-118326"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-0124"
      },
      {
        "db": "BID",
        "id": "103114"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-002414"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201802-441"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-0124"
      }
    ]
  },
  "sources": {
    "_id": null,
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-118326",
        "ident": null
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-0124",
        "ident": null
      },
      {
        "db": "BID",
        "id": "103114",
        "ident": null
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-002414",
        "ident": null
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201802-441",
        "ident": null
      },
      {
        "db": "NVD",
        "id": "CVE-2018-0124",
        "ident": null
      }
    ]
  },
  "sources_release_date": {
    "_id": null,
    "data": [
      {
        "date": "2018-02-22T00:00:00",
        "db": "VULHUB",
        "id": "VHN-118326",
        "ident": null
      },
      {
        "date": "2018-02-22T00:00:00",
        "db": "VULMON",
        "id": "CVE-2018-0124",
        "ident": null
      },
      {
        "date": "2018-02-21T00:00:00",
        "db": "BID",
        "id": "103114",
        "ident": null
      },
      {
        "date": "2018-04-11T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-002414",
        "ident": null
      },
      {
        "date": "2018-02-22T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201802-441",
        "ident": null
      },
      {
        "date": "2018-02-22T00:29:00.267000",
        "db": "NVD",
        "id": "CVE-2018-0124",
        "ident": null
      }
    ]
  },
  "sources_update_date": {
    "_id": null,
    "data": [
      {
        "date": "2019-10-09T00:00:00",
        "db": "VULHUB",
        "id": "VHN-118326",
        "ident": null
      },
      {
        "date": "2019-10-09T00:00:00",
        "db": "VULMON",
        "id": "CVE-2018-0124",
        "ident": null
      },
      {
        "date": "2018-02-21T00:00:00",
        "db": "BID",
        "id": "103114",
        "ident": null
      },
      {
        "date": "2018-04-11T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-002414",
        "ident": null
      },
      {
        "date": "2019-10-17T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201802-441",
        "ident": null
      },
      {
        "date": "2024-11-21T03:37:34.243000",
        "db": "NVD",
        "id": "CVE-2018-0124",
        "ident": null
      }
    ]
  },
  "threat_type": {
    "_id": null,
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201802-441"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "_id": null,
    "data": "Cisco Unified Communications Domain Manager Vulnerabilities related to key management errors",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-002414"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "_id": null,
    "data": "encryption problem",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201802-441"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.