CVE-2014-3316

Vulnerability

The Multiple Analyzer in the Dialed Number Analyzer (DNA) component of Cisco Unified Communications Manager contains a vulnerability that allows remote authenticated users to bypass intended upload restrictions. The bug is triggered by sending a crafted parameter to the affected component, as identified by Cisco bug ID CSCup76297 [2]. Affected versions include Cisco Unified Communications Manager prior to the fix applied in response to this CVE [2].

Exploitation

An attacker must have valid authentication credentials for the Cisco Unified Communications Manager system [2]. The attacker then crafts a specific parameter and sends it to the Multiple Analyzer within the DNA component. No additional user interaction or network position beyond standard authenticated access to the management interface is required [2].

Impact

Successful exploitation allows the attacker to bypass file upload restrictions enforced by the Multiple Analyzer [2]. This could enable the attacker to upload files that would otherwise be blocked, potentially leading to further compromise of the system or disclosure of sensitive information [2].

Mitigation

Cisco has released a security notice for this vulnerability [2]. The fix is included in a software update for Cisco Unified Communications Manager [2]. Administrators should apply the latest patched version as provided by Cisco. No workarounds are documented in the available references [2].