how to address some Vulnerabilities in cisco collaboration apps

[engreda22]

Dear All ,

As result of PCI , I have to address vulnerabilities related to cucm , cuc and ccx as listed below

1- OpenSSH < 7.0 Multiple Vulnerabilities :-

OpenSSH contains a vulnerability which can allow a remote attacker to bypass the XSECURITY restrictions when forwarding X11 connections by making use of an ineffective
timeout check.

need to upgrade to ssh >7
2- Triple DES Birthday Attack Vulnerability (Sweet32) :-

The Triple-DES cipher algorithm contains a vulnerability which can allow an attacker to recover secure HTTP cookies when performing a man-in-the-middle attack.

need to Disable Triple-DES Ciphers on the system

please let me know how to fix those two vulnerabilities

cucm ver 12.0.1

thanks

[Jonathan Schulenberg]

What are the CVE identifiers for the vulnerabilities identified? Has Cisco published a PSIRT for that CVE with stated plans how they intend to address it?
https://tools.cisco.com/security/center/publicationListing.x

As for the cipher suites, you can now adjust them in CUCM 12.0 but doing so comes with a big warning that you are responsible for testing/qualifying every component in your solution supports stronger ciphers than the ones you disable. Older phones and gateways will be the most likely problematic points.
https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/12_5_1/cucm_b_security-guide-1251/cucm_b_security-guide-1251_chapter_01.html#reference_68972012B0460E00571F79B1735FC5E9

[engreda22]

Thanks Jonathan for your reply.
The CVE of the first vulnerability is CVE-2015-5352 and recorded in non-Cisco product
https://tools.cisco.com/security/center/viewAlert.x?alertId=41120
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5352
However in PCI scan report it shows in cisco unity and as attached.

[engreda22]

Also I checked the procedure of changing the cipher suite but it is not applicable in my CM OS
1- From Cisco Unified OS Administration, choose Security > Cipher Management. (this is not available option)
please check attached