Cisco Issues Security Patch for Vulnerabilities in Unified Communications Manager(2)

Cisco released a security patch addressing some of the vulnerabilities in its Unified Communications Manager (Unified CM). The said vulnerabilities may allow hackers to take control of affected systems. Denial-of-service (DDoS) vulnerabilities in Cisco's Intrusion Prevention System software were also patched.

Cisco's clients can download the file (cmterm-CSCuh01051-2.cop.sgn) from the company's website. They can install it until the next patched version of Unified CM is released.

A security advisory made available on July 17, 2013 described the impact of the attack as follows: "Successful exploitation of the blind SQL injection vulnerabilities could allow a remote attacker to reconstruct encrypted credentials and insert rows in the Cisco Unified CM database. The initial blind SQL injection allows an unauthenticated, remote attacker to use the hard-coded encryption key to obtain and decrypt a local user account. This allows for a subsequent, authenticated blind SQL injection."

According to Cisco, the security patch is released in the form of a Cisco Options Package (COP), lessening the effect of the initial attack vector and minimizing the documented attack surface.

However, other vulnerabilities have not been patched yet. Cisco said that they are still investigating the other vulnerabilities and workarounds are still yet to be devised in order to counteract them.

The Cisco Unified CM is a call processing product that enables enterprise telephony capabilities to be extended to IP phones, media processing devices, multimedia applications, and VoIP gateways. The publicly demonstrated attack affects the following versions of Unified CM: 7.1.x, 8.5.x, 8.6.x, 9.0.x, and 9.1.x. Version 8.0 is not affected, but Cisco no longer supports it. Cisco clients who still use Unified CM version 8.0 are asked to contact the company so that they can be assisted in upgrading to a supported version.

In addition, Cisco released an advisory concerning some DDoS vulnerabilities that affect the software running on some of its Intrusion Prevention System (IPS) products, including the ASA 5500-X series IPS security services processor (IPS SSP) software and hardware modules, IPS 4500 series sensors, IPS 4300 series sensors, IPS Network Module Enhanced (NME), and Catalyst 6500 series Intrusion Detection System (IDSM-2) module. Patched versions of the IPS software for the aforementioned products have been released, except for IDSM-2-where a workaround was made available. (KOM) Link. Link. Link.