CVE-2017-12249 - Exposure of Resource to Wrong Sphere

Severity

90%

Complexity

80%

Confidentiality

165%

A vulnerability in the Traversal Using Relay NAT (TURN) server included with Cisco Meeting Server (CMS) could allow an authenticated, remote attacker to gain unauthenticated or unauthorized access to components of or sensitive information in an affected system. The vulnerability is due to an incorrect default configuration of the TURN server, which could expose internal interfaces and ports on the external interface of an affected system. An attacker could exploit this vulnerability by using a TURN server to perform an unauthorized connection to a Call Bridge, a Web Bridge, or a database cluster in an affected system, depending on the deployment model and CMS services in use. A successful exploit could allow the attacker to gain unauthenticated access to a Call Bridge or database cluster in an affected system or gain unauthorized access to sensitive meeting information in an affected system. To exploit this vulnerability, the attacker must have valid credentials for the TURN server of the affected system. This vulnerability affects Cisco Meeting Server (CMS) deployments that are running a CMS Software release prior to Release 2.0.16, 2.1.11, or 2.2.6. Cisco Bug IDs: CSCvf51127.

A vulnerability in the Traversal Using Relay NAT (TURN) server included with Cisco Meeting Server (CMS) could allow an authenticated, remote attacker to gain unauthenticated or unauthorized access to components of or sensitive information in an affected system. The vulnerability is due to an incorrect default configuration of the TURN server, which could expose internal interfaces and ports on the external interface of an affected system. An attacker could exploit this vulnerability by using a TURN server to perform an unauthorized connection to a Call Bridge, a Web Bridge, or a database cluster in an affected system, depending on the deployment model and CMS services in use. A successful exploit could allow the attacker to gain unauthenticated access to a Call Bridge or database cluster in an affected system or gain unauthorized access to sensitive meeting information in an affected system. To exploit this vulnerability, the attacker must have valid credentials for the TURN server of the affected system. This vulnerability affects Cisco Meeting Server (CMS) deployments that are running a CMS Software release prior to Release 2.0.16, 2.1.11, or 2.2.6. Cisco Bug IDs: CSCvf51127.

CVSS 3.0 Base Score 9.1. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

CVSS 2.0 Base Score 9. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (AV:N/AC:L/Au:S/C:C/I:C/A:C).

Overview

Type

Cisco Meeting Server

First reported 7 years ago

2017-09-13 22:29:00

Last updated 5 years ago

2019-10-09 23:22:00

Affected Software

Cisco Meeting Server 2.1.0

2.1.0

Cisco Meeting Server 2.1.1

2.1.1

Cisco Meeting Server 2.1.2

2.1.2

Cisco Meeting Server 2.1.3

2.1.3

Cisco Meeting Server 2.1.4

2.1.4

Cisco Meeting Server 2.1.5

2.1.5

Cisco Meeting Server 2.1.6

2.1.6

Cisco Meeting Server 2.1.7

2.1.7

Cisco Meeting Server 2.1.8

2.1.8

Cisco Meeting Server 2.1.9

2.1.9

Cisco Meeting Server 2.1.10

2.1.10

Cisco Meeting Server 2.2.0

2.2.0

Cisco Meeting Server 2.2.1

2.2.1

Cisco Meeting Server 2.2.2

2.2.2

Cisco Meeting Server 2.2.3

2.2.3

Cisco Meeting Server 2.2.4

2.2.4

Cisco Meeting Server 2.2.5

2.2.5

References

100821

Third Party Advisory, VDB Entry

1039357

Third Party Advisory, VDB Entry

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170913-cmsturn

Vendor Advisory

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.