SB2017091401 - Security restrictions bypass in Cisco Meeting Server



SB2017091401 - Security restrictions bypass in Cisco Meeting Server

Published: September 14, 2017 Updated: September 14, 2017

Security Bulletin ID SB2017091401
Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Security restrictions bypass (CVE-ID: CVE-2017-12249)

The vulnerability allows a remote authenticated attacker to gain unauthenticated or unauthorized access to components of sensitive information.

The weakness exists due to incorrect default configuration of the TURN server. A remote attacker can use a TURN server, depending on the deployment model and CMS services in use to perform an unauthorized connection to a Call Bridge, a Web Bridge, or a database cluster and gain unauthorized access to sensitive meeting information. Successful exploitation of the vulnerability is able if the attacker has valid credentials for the TURN server.


Remediation

Install update from vendor's website.