Cisco Patches Severe Vulnerabilities in Prime Collaboration Provisioning
8.6.18 securityweek Vulnerebility

Cisco informed customers this week that it has patched one critical and five high severity vulnerabilities in Prime Collaboration Provisioning (PCP), a web-based provisioning solution that allows organizations to manage their communications services.

The critical flaw, CVE-18-0321, allows a remote and unauthenticated attacker to access the Java Remote Method Invocation (RMI) system and perform actions that affect both the PCP and the devices connected to it.

The list of high severity vulnerabilities affecting PCP includes two issues that allow an unauthenticated attacker to reset the password on affected systems and gain admin-level privileges by sending a specially crafted password reset request.

Another high severity bug allows an unauthenticated attacker to execute arbitrary SQL queries. The remaining high severity vulnerabilities are access control issues that allow authenticated attackers to elevate their privileges.

Users can patch all the PCP vulnerabilities by updating to version 12.3, but fixes for some of these flaws are included in versions 12.1 and 12.2. The security holes have been identified by Cisco during internal security testing and there is no evidence of exploitation in the wild.

Cisco also fixed a critical vulnerability, tracked as CVE-18-0315, it the authentication, authorization, and accounting (AAA) security services of Cisco IOS XE software. An attacker can exploit this flaw remotely to execute arbitrary code on a device or cause a denial-of-service (DoS) condition.

Other high severity problems patched this week include DoS vulnerabilities in IP Phone and Adaptive Security Appliance (ASA) products, a security bypass in Cisco Web Security Appliance (WSA), and a command execution vulnerability in Network Services Orchestrator (NSO).

Cisco’s advisories also describe an information disclosure bug in Meeting Server, and a DoS vulnerability impacting multiple products.

Patches are available for all these flaws and there is no evidence of malicious exploitation.