Cisco Unified CallManager Multiple Remote Vulnerabilities

Bugtraq ID:	18952
Class:	Unknown
CVE:	CVE-2006-3594 CVE-2006-3592 CVE-2006-3593
Remote:	Yes
Local:	Yes
Published:	Jul 12 2006 12:00AM
Updated:	Jul 05 2016 09:38PM
Credit:	These issues were reported by the vendor.
Vulnerable:	Cisco Unified CallManager 5.0(3a) Cisco Unified CallManager 5.0(3) Cisco Unified CallManager 5.0(2) Cisco Unified CallManager 5.0(1)
Not Vulnerable:	Cisco Unified CallManager 5.0(4)

Cisco Unified CallManager Multiple Remote Vulnerabilities

Cisco Unified CallManager is susceptible to multiple remote vulnerabilities. These specific issues are identified:

- A local privilege-escalation vulnerability, documented as Cisco bug CSCse11005
- A local file-overwrite vulnerability, documented as Cisco bug CSCse31704
- A remote buffer-overflow vulnerability, documented as Cisco bug CSCsd96542

These issues allow local attackers to completely compromise affected devices, and remote attackers to execute arbitrary machine code in the context of the affected service.

Cisco Unified CallManager Multiple Remote Vulnerabilities

The local issues do not require an exploit.

Currently we are not aware of any exploits for the remote issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Cisco Unified CallManager Multiple Remote Vulnerabilities

Solution:
Cisco has released an advisory along with fixes to address this issue. Please see the referenced advisory for details and for information on obtaining fixes.

Cisco Unified CallManager Multiple Remote Vulnerabilities

References:

• CallManager Product Page (Cisco)
  
• Cisco Security Advisory: Multiple Cisco Unified CallManager Vulnerabilities (Cisco)