CVE-2015-6414

Cisco TelePresence Video Communication Server (VCS) X8.6 uses the same encryption key across different customers' installations, which makes it easier for local users to defeat cryptographic protection mechanisms by leveraging knowledge of a key from another installation, aka Bug ID CSCuw64516.

CVSS v2.0 2.1 LOW

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151210-tvcs	Vendor Advisory
http://www.securityfocus.com/bid/79065
http://www.securitytracker.com/id/1034429
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151210-tvcs	Vendor Advisory
http://www.securityfocus.com/bid/79065
http://www.securitytracker.com/id/1034429

Configurations

Configuration 1 (hide)

cpe:2.3:a:cisco:telepresence_video_communication_server_software:x8.6:*:*:*:*:*:*:*

History

21 Nov 2024, 02:34

Type	Values Removed	Values Added
References	~~() http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151210-tvcs - Vendor Advisory~~	() http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151210-tvcs - Vendor Advisory
References	~~() http://www.securityfocus.com/bid/79065 -~~	() http://www.securityfocus.com/bid/79065 -
References	~~() http://www.securitytracker.com/id/1034429 -~~	() http://www.securitytracker.com/id/1034429 -

Information

Published : 2015-12-13 03:59

Updated : 2024-11-21 02:34

NVD link : CVE-2015-6414

Mitre link : CVE-2015-6414

CVE.ORG link : CVE-2015-6414

JSON object : View

Products Affected

cisco

telepresence_video_communication_server_software

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2015-6414", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-12-13T03:59:08.400", "references": [{"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151210-tvcs", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securityfocus.com/bid/79065", "source": "ykramarz@cisco.com"}, {"url": "http://www.securitytracker.com/id/1034429", "source": "ykramarz@cisco.com"}, {"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151210-tvcs", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/79065", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securitytracker.com/id/1034429", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "Cisco TelePresence Video Communication Server (VCS) X8.6 uses the same encryption key across different customers' installations, which makes it easier for local users to defeat cryptographic protection mechanisms by leveraging knowledge of a key from another installation, aka Bug ID CSCuw64516."}, {"lang": "es", "value": "Cisco TelePresence Video Communication Server (VCS) X8.6 utiliza la misma clave de cifrado a trav\u00e9s de instalaciones de clientes diferentes, lo que hace que sea m\u00e1s f\u00e1cil para usuarios locales vencer el mecanismo de protecci\u00f3n criptogr\u00e1fico aprovechando el conocimiento de una clave de otra instalaci\u00f3n, tambi\u00e9n conocido como Bug ID CSCuw64516."}], "lastModified": "2024-11-21T02:34:57.250", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:telepresence_video_communication_server_software:x8.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2E0A40E6-0579-498C-9832-46E10EDB2FD3"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}