CVE-2016-6445

A vulnerability in the Extensible Messaging and Presence Protocol (XMPP) service of the Cisco Meeting Server (CMS) before 2.0.6 and Acano Server before 1.8.18 and 1.9.x before 1.9.6 could allow an unauthenticated, remote attacker to masquerade as a legitimate user. This vulnerability is due to the XMPP service incorrectly processing a deprecated authentication scheme. A successful exploit could allow an attacker to access the system as another user.

CVSS v3 9.1 CRITICAL
CVSS v2.0 6.4 MEDIUM

9.1^/10

CVSS v3 : CRITICAL

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

6.4^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:N

Exploitability : 10.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161012-msc	Mitigation Vendor Advisory
http://www.securityfocus.com/bid/93517
http://www.securitytracker.com/id/1037000

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:cisco:meeting_server:1.8.15:::::::*
	cpe:2.3:a:cisco:meeting_server:1.8_base:::::::*
	cpe:2.3:a:cisco:meeting_server:1.9.0:::::::*
	cpe:2.3:a:cisco:meeting_server:1.9.2:::::::*
	cpe:2.3:a:cisco:meeting_server:2.0.0:::::::*
	cpe:2.3:a:cisco:meeting_server:2.0.1:::::::*
	cpe:2.3:a:cisco:meeting_server:2.0.3:::::::*
	cpe:2.3:a:cisco:meeting_server:2.0.4:::::::*
	cpe:2.3:a:cisco:meeting_server:2.0.5:::::::*

History

No history.

Information

Published : 2016-10-27 21:59

Updated : 2024-02-04 18:53

NVD link : CVE-2016-6445

Mitre link : CVE-2016-6445

CVE.ORG link : CVE-2016-6445

JSON object : View

Products Affected

cisco

meeting_server

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2016-6445", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.4, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "published": "2016-10-27T21:59:17.063", "references": [{"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161012-msc", "tags": ["Mitigation", "Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securityfocus.com/bid/93517", "source": "ykramarz@cisco.com"}, {"url": "http://www.securitytracker.com/id/1037000", "source": "ykramarz@cisco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the Extensible Messaging and Presence Protocol (XMPP) service of the Cisco Meeting Server (CMS) before 2.0.6 and Acano Server before 1.8.18 and 1.9.x before 1.9.6 could allow an unauthenticated, remote attacker to masquerade as a legitimate user. This vulnerability is due to the XMPP service incorrectly processing a deprecated authentication scheme. A successful exploit could allow an attacker to access the system as another user."}, {"lang": "es", "value": "Una vulnerabilidad en el servicio Extensible Messaging y Presence Protocol (XMPP) del Cisco Meeting Server (CMS) en versiones anteriores a 2.0.6 y Acano Server en versiones anteriores a 1.8.18 y 1.9.x en versiones anteriores a 1.9.6 podr\u00eda permitir a un atacante remoto no autenticado enmascararse como un usuario leg\u00edtimo. Esta vulnerabilidad se debe a que el servicio XMPP no procesa correctamente un esquema de autenticaci\u00f3n en desuso. Una explotaci\u00f3n exitosa puede permitir a un atacante acceder al sistema como otro usuario."}], "lastModified": "2017-07-30T01:29:13.273", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:meeting_server:1.8.15:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B8E4843E-E44A-42E8-B83D-AEFC7A8BCE13"}, {"criteria": "cpe:2.3:a:cisco:meeting_server:1.8_base:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0CD09398-8DBF-4467-9BE3-A9297AE247AB"}, {"criteria": "cpe:2.3:a:cisco:meeting_server:1.9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1691992B-DD39-43CA-BD51-800EEE19F224"}, {"criteria": "cpe:2.3:a:cisco:meeting_server:1.9.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "53619071-8A6A-4230-BDEF-B0E1461217C0"}, {"criteria": "cpe:2.3:a:cisco:meeting_server:2.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C48DC084-1DD2-4878-B1DB-1035CAE3B918"}, {"criteria": "cpe:2.3:a:cisco:meeting_server:2.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1CA9A904-9AB5-4757-ABD1-0F6F933799BE"}, {"criteria": "cpe:2.3:a:cisco:meeting_server:2.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8FA8A21E-97BA-4326-9F7B-FCBD480134EF"}, {"criteria": "cpe:2.3:a:cisco:meeting_server:2.0.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1E6FA3F5-752D-45AB-A8CB-6488F409D933"}, {"criteria": "cpe:2.3:a:cisco:meeting_server:2.0.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4B80C9BA-07EC-4183-9AAD-3229913C9FD7"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}