CVE-2015-6410
published 2015-12-14CVE-2015-6410: The Mobile and Remote Access (MRA) services implementation in Cisco Unified Communications Manager mishandles edge-device identity validation, which allows…
PriorityP425medium4CVSS 2.0
AVNACLAuSCPINAN
EPSS
1.68%
74.3th percentile
The Mobile and Remote Access (MRA) services implementation in Cisco Unified Communications Manager mishandles edge-device identity validation, which allows remote attackers to bypass intended call-reception and call-setup restrictions by spoofing a user, aka Bug ID CSCuu97283.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | telepresence_video_communication_server_software | — | — |
| cisco | unified_communications_manager_mobile_and | — | — |
| wouter_verhelst | nbd | >= 0 < 1:3.7-1ubuntu0.1 | 1:3.7-1ubuntu0.1 |
CVSS provenance
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
osv7.5HIGH
vendor_cisco4.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-vjgm-xxw7-95f8: The Mobile and Remote Access (MRA) services implementation in Cisco Unified Communications Manager mishandles edge-device identity validation, which a
ghsa_unreviewed·2022-05-17
CVE-2015-6410 [MEDIUM] CWE-20 GHSA-vjgm-xxw7-95f8: The Mobile and Remote Access (MRA) services implementation in Cisco Unified Communications Manager mishandles edge-device identity validation, which a
The Mobile and Remote Access (MRA) services implementation in Cisco Unified Communications Manager mishandles edge-device identity validation, which allows remote attackers to bypass intended call-reception and call-setup restrictions by spoofing a user, aka Bug ID CSCuu97283.
OSV
nbd vulnerabilities
osv·2015-07-22·CVSS 7.5
CVE-2013-6410 nbd vulnerabilities
nbd vulnerabilities
It was discovered that NBD incorrectly handled IP address matching. A
remote attacker could use this issue with an IP address that has a partial
match and bypass access restrictions. This issue only affected
Ubuntu 12.04 LTS. (CVE-2013-6410)
Tuomas Räsänen discovered that NBD incorrectly handled wrong export names
and closed connections during negotiation. A remote attacker could use this
issue to cause NBD to crash, resulting in a denial of service. This issue
only affected Ubuntu 12.04 LTS. (CVE-2013-7441)
Tuomas Räsänen discovered that NBD incorrectly handled signals. A remote
attacker could use this issue to cause NBD to crash, resulting in a denial
of service. (CVE-2015-0847)
Cisco
Cisco Unified Communications Manager Mobile and Remote Access Services Identity Attack Vulnerability
vendor_cisco·2015-12-09·CVSS 4.0
CVE-2015-6410 [MEDIUM] CWE-20 Cisco Unified Communications Manager Mobile and Remote Access Services Identity Attack Vulnerability
Cisco Unified Communications Manager Mobile and Remote Access Services Identity Attack Vulnerability
A vulnerability in edge devices of the Cisco Unified Communications Manager using Mobile and Remote Access (MRA) services could allow an unauthenticated, remote attacker to perform an identity theft attack.
The vulnerability is due to improper identity validation of the edge devices. An attacker could exploit this vulnerability by spoofing a user's identity and taking ownership of the edge device. A successful exploit will allow the attacker to setup and receive voice calls acting as the registered user of the device.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This advisory is available at the following
Cisco
Cisco Unified Communications Manager Mobile and Remote Access Services Identity Attack Vulnerability
vendor_cisco
CVE-2015-6410 Cisco Unified Communications Manager Mobile and Remote Access Services Identity Attack Vulnerability
CVE-2015-6410: Cisco Unified Communications Manager Mobile and Remote Access Services Identity Attack Vulnerability
A vulnerability in edge devices of the Cisco Unified Communications Manager using Mobile and Remote Access (MRA) services could allow an unauthenticated, remote attacker to perform an identity theft attack. The vulnerability is due to improper identity validation of the edge devices. An attacker could exploit this vulnerability by spoofing a user's identity and taking ownership of the edge device. A successful exploit will allow the attacker to setup and receive voice calls acting as the registered user of the device. Cisco has released software updates that address this vulnerability. There are no
CWE: CWE-20, CWE-20
Bug IDs: CSCuu97283
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151209-ucmhttp://www.securityfocus.com/bid/78741http://www.securitytracker.com/id/1034377http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151209-ucmhttp://www.securityfocus.com/bid/78741http://www.securitytracker.com/id/1034377
2015-12-14
Published