Details of VAR-201607-0425

ID

VAR-201607-0425

CVE

CVE-2016-1444

TITLE

Cisco TelePresence Video Communication Server and Expressway of Mobile and Remote Access Vulnerabilities that bypass authentication in components

Trust: 0.8

sources: JVNDB: JVNDB-2016-003511

DESCRIPTION

The Mobile and Remote Access (MRA) component in Cisco TelePresence Video Communication Server (VCS) X8.1 through X8.7 and Expressway X8.1 through X8.6 mishandles certificates, which allows remote attackers to bypass authentication via an arbitrary trusted certificate, aka Bug ID CSCuz64601. Vendors have confirmed this vulnerability Bug ID CSCuz64601 It is released as.A third party could bypass authentication through any trusted certificate. A remote attacker can exploit this vulnerability to bypass identity and access internal HTTP system resources. An attacker can exploit this issue to perform man-in-the-middle attacks and perform certain unauthorized actions, which will aid in further attacks. This issue is being tracked by Cisco Bug ID CSCuz64601. The vulnerability is caused by the program not correctly verifying trusted certificates

Trust: 2.61

sources: NVD: CVE-2016-1444 // JVNDB: JVNDB-2016-003511 // CNVD: CNVD-2016-04617 // BID: 91669 // VULHUB: VHN-90263 // VULMON: CVE-2016-1444

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2016-04617

AFFECTED PRODUCTS

vendor:	cisco	model:	telepresence video communication server	scope:	eq	version:	x8.6.0	Trust: 1.6
vendor:	cisco	model:	telepresence video communication server	scope:	eq	version:	x8.5.3	Trust: 1.6
vendor:	cisco	model:	telepresence video communication server	scope:	eq	version:	x8.1.2	Trust: 1.6
vendor:	cisco	model:	telepresence video communication server	scope:	eq	version:	x8.5	Trust: 1.6
vendor:	cisco	model:	telepresence video communication server	scope:	eq	version:	x8.1.1	Trust: 1.6
vendor:	cisco	model:	telepresence video communication server software	scope:	eq	version:	x8.5.3	Trust: 1.6
vendor:	cisco	model:	telepresence video communication server	scope:	eq	version:	x8.2.1	Trust: 1.6
vendor:	cisco	model:	telepresence video communication server	scope:	eq	version:	x8.2.2	Trust: 1.6
vendor:	cisco	model:	telepresence video communication server	scope:	eq	version:	x8.5.2	Trust: 1.0
vendor:	cisco	model:	telepresence video communication server	scope:	eq	version:	x8.6.1	Trust: 1.0
vendor:	cisco	model:	telepresence video communication server software	scope:	eq	version:	x8.5.1	Trust: 1.0
vendor:	cisco	model:	telepresence video communication server software	scope:	eq	version:	x8.6	Trust: 1.0
vendor:	cisco	model:	telepresence video communication server	scope:	eq	version:	x8.2	Trust: 1.0
vendor:	cisco	model:	telepresence video communication server	scope:	eq	version:	x8.5.0	Trust: 1.0
vendor:	cisco	model:	telepresence video communication server	scope:	eq	version:	x8.7	Trust: 1.0
vendor:	cisco	model:	telepresence video communication server software	scope:	eq	version:	x8.5.2	Trust: 1.0
vendor:	cisco	model:	telepresence video communication server	scope:	eq	version:	x8.5.1	Trust: 1.0
vendor:	cisco	model:	telepresence video communication server	scope:	eq	version:	x8.1	Trust: 1.0
vendor:	cisco	model:	telepresence video communication server software	scope:	eq	version:	expressway x8.1 to x8.6	Trust: 0.8
vendor:	cisco	model:	telepresence video communication server software	scope:	eq	version:	x8.1 to x8.7	Trust: 0.8
vendor:	cisco	model:	telepresence video communication server	scope:	gte	version:	x8.1	Trust: 0.6
vendor:	cisco	model:	expressway	scope:	gte	version:	x8.1	Trust: 0.6
vendor:	cisco	model:	telepresence video communication server	scope:	eq	version:	x8.1_base	Trust: 0.6
vendor:	cisco	model:	telepresence video communication server	scope:	eq	version:	x8.2_base	Trust: 0.6
vendor:	cisco	model:	telepresence video communication server	scope:	eq	version:	0	Trust: 0.3

sources: CNVD: CNVD-2016-04617 // BID: 91669 // JVNDB: JVNDB-2016-003511 // CNNVD: CNNVD-201607-037 // NVD: CVE-2016-1444

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2016-1444
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2016-1444
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2016-04617
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201607-037
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-90263
value:	MEDIUM
Trust: 0.1
VULMON:	CVE-2016-1444
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2016-1444
severity:	MEDIUM
baseScore:	5.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
CNVD:	CNVD-2016-04617
severity:	MEDIUM
baseScore:	5.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-90263
severity:	MEDIUM
baseScore:	5.8
vectorString:	AV:N/AC:M/AU:N/C:P/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2016-1444
baseSeverity:	MEDIUM
baseScore:	6.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	2.5
version:	3.1
Trust: 1.0
NVD:	CVE-2016-1444
baseSeverity:	MEDIUM
baseScore:	6.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2016-04617 // VULHUB: VHN-90263 // VULMON: CVE-2016-1444 // JVNDB: JVNDB-2016-003511 // CNNVD: CNNVD-201607-037 // NVD: CVE-2016-1444

PROBLEMTYPE DATA

problemtype:

CWE-20

Trust: 1.9

sources: VULHUB: VHN-90263 // JVNDB: JVNDB-2016-003511 // NVD: CVE-2016-1444

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201607-037

TYPE

Input Validation Error

Trust: 0.9

sources: BID: 91669 // CNNVD: CNNVD-201607-037

CONFIGURATIONS

sources: JVNDB: JVNDB-2016-003511

PATCH

title:	cisco-sa-20160706-vcs	url:	http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160706-vcs	Trust: 0.8
title:	CiscoVideoCommunicationServer and Expressway Identity Bypass Vulnerability Patch	url:	https://www.cnvd.org.cn/patchInfo/show/78714	Trust: 0.6
title:	Cisco Video Communication Server and Expressway Repair measures for security bypass vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=62629	Trust: 0.6

sources: CNVD: CNVD-2016-04617 // JVNDB: JVNDB-2016-003511 // CNNVD: CNNVD-201607-037

EXTERNAL IDS

db:	NVD	id:	CVE-2016-1444	Trust: 3.5
db:	BID	id:	91669	Trust: 2.7
db:	SECTRACK	id:	1036237	Trust: 1.8
db:	JVNDB	id:	JVNDB-2016-003511	Trust: 0.8
db:	CNNVD	id:	CNNVD-201607-037	Trust: 0.7
db:	CNVD	id:	CNVD-2016-04617	Trust: 0.6
db:	VULHUB	id:	VHN-90263	Trust: 0.1
db:	VULMON	id:	CVE-2016-1444	Trust: 0.1

sources: CNVD: CNVD-2016-04617 // VULHUB: VHN-90263 // VULMON: CVE-2016-1444 // BID: 91669 // JVNDB: JVNDB-2016-003511 // CNNVD: CNNVD-201607-037 // NVD: CVE-2016-1444

REFERENCES

url:	http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20160706-vcs	Trust: 2.4
url:	http://www.securityfocus.com/bid/91669	Trust: 1.8
url:	http://www.securitytracker.com/id/1036237	Trust: 1.8
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-1444	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-1444	Trust: 0.8
url:	http://www.cisco.com/	Trust: 0.3
url:	https://cwe.mitre.org/data/definitions/20.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: CNVD: CNVD-2016-04617 // VULHUB: VHN-90263 // VULMON: CVE-2016-1444 // BID: 91669 // JVNDB: JVNDB-2016-003511 // CNNVD: CNNVD-201607-037 // NVD: CVE-2016-1444

CREDITS

The vendor reported this issue.

Trust: 0.3

sources: BID: 91669

SOURCES

db:	CNVD	id:	CNVD-2016-04617
db:	VULHUB	id:	VHN-90263
db:	VULMON	id:	CVE-2016-1444
db:	BID	id:	91669
db:	JVNDB	id:	JVNDB-2016-003511
db:	CNNVD	id:	CNNVD-201607-037
db:	NVD	id:	CVE-2016-1444

LAST UPDATE DATE

2024-11-23T22:18:15.157000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2016-04617	date:	2016-07-08T00:00:00
db:	VULHUB	id:	VHN-90263	date:	2020-08-27T00:00:00
db:	VULMON	id:	CVE-2016-1444	date:	2020-08-27T00:00:00
db:	BID	id:	91669	date:	2016-07-08T20:38:00
db:	JVNDB	id:	JVNDB-2016-003511	date:	2016-07-12T00:00:00
db:	CNNVD	id:	CNNVD-201607-037	date:	2020-10-28T00:00:00
db:	NVD	id:	CVE-2016-1444	date:	2024-11-21T02:46:27.317

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2016-04617	date:	2016-07-08T00:00:00
db:	VULHUB	id:	VHN-90263	date:	2016-07-07T00:00:00
db:	VULMON	id:	CVE-2016-1444	date:	2016-07-07T00:00:00
db:	BID	id:	91669	date:	2016-07-06T00:00:00
db:	JVNDB	id:	JVNDB-2016-003511	date:	2016-07-12T00:00:00
db:	CNNVD	id:	CNNVD-201607-037	date:	2016-07-07T00:00:00
db:	NVD	id:	CVE-2016-1444	date:	2016-07-07T14:59:05.970