Cisco Unity Express Expired Password Privilege Escalation Vulnerability

Bugtraq ID:	17775
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 02 2006 12:00AM
Updated:	May 02 2006 11:05PM
Credit:	Discovered by Xu He and Keith Vaughan of the Bank of America Application Assessment Team.
Vulnerable:	Cisco Unity Express 2.2(2) Cisco Unity Express 2.1(1) Cisco Unity Express 1.1(1) Cisco Unity Express
Not Vulnerable:	Cisco Unity Express 2.3(1)

Cisco Unity Express Expired Password Privilege Escalation Vulnerability


Cisco Unity Express (CUE) is prone to a privilege-escalation vulnerability. An attacker could reset the password of a privileged account that has an expired password.

CUE Advanced Integration Module (AIM) or Network Module (NM) running CUE software versions prior to 2.3(1) are affected by this issue.

Cisco Unity Express Expired Password Privilege Escalation Vulnerability


This vulnerability could be exploited through a web browser.

Cisco Unity Express Expired Password Privilege Escalation Vulnerability

Solution:

Fixes are available. Please see the referenced Cisco advisory for details.

Cisco Unity Express Expired Password Privilege Escalation Vulnerability

References:

• Cisco Security Advisory: Cisco Unity Express Expired Password Reset Privilege Es (Cisco)
  
• Cisco Unity Express (Cisco)