Watchcom immediately reported these vulnerabilities to Cisco and coordinated a responsible disclosure. The most severe vulnerability can be used to automatically spread malware without any user interaction. The vulnerabilities can be used to gain remote code execution. Continue reading “Cisco Unified CM User Data Service (UDS)”ĭuring a recent penetration test for an unrelated client, security consultants from Watchcom discovered four serious vulnerabilities in Cisco Jabber. This ensures that client interaction with the UDS service avoids the publisher node and instead distributes the load across call processing nodes within the cluster. While the UDS service runs on all nodes in the Unified CM cluster, when configuring DNS SRV records for Unified CM UDS service, administrators should configure records for resolution to Unified CM subscriber nodes only. You can populate the UDS contact source data by using the Unified CM web interface (by creating end users),by using the LDAP sync function to Active Directory or other supported LDAP source, or by using the UDS-to-LDAP Proxy function. The UDS contact service is always used for remote Jabber clients connected over MRA access and it is an optional contact service for clients on the corporate network.
This enables Jabber clients to search a corporate directory that exceeds the maximum number of users supported within Unified CM. When enabled, contact searches are still handled by UDS but are proxied to the corporate LDAP directory, with UDS relaying results back to the Jabber client. The UDS contact source uses the Unified CM end user table information to provide a contact lookup service.īeginning with Cisco Unified CM 11.5, the UDS-to-LDAP Proxy feature can also be used for contact searches. UDS provides a contact source API that can be used by Jabber over Cisco Expressway mobile and remote access (MRA) for the contact source.
0 kommentar(er)
