News
Vigil@nce - Cisco Unified Communications Manager: identity theft via MRA
February 2016 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
An attacker can bypass the identification of Cisco Unified
Communications Manager with the MRA service, in order to spoof the
identity of a device.
Impacted products: Cisco CUCM.
Severity: 2/4.
Creation date: 10/12/2015.
DESCRIPTION OF THE VULNERABILITY
The Cisco Unified Communications Manager uses the Mobile and
Remote Access service, requiring an authentication for devices.
However, a missing identity control of devices allows a remote
attacker to steal the identity of the device, and then to receive
and record its calls.
An attacker can therefore bypass the identity validation by Cisco
Unified Communications Manager with the MRA service, in order to
spoof the identity of a device.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/Cisco-Unified-Communications-Manager-identity-theft-via-MRA-18490
