Cisco Unified Communications Disaster Recovery Framework Remote Command Execution Vulnerability
BID:28591
Info
Cisco Unified Communications Disaster Recovery Framework Remote Command Execution Vulnerability
| Bugtraq ID: | 28591 |
| Class: | Access Validation Error |
| CVE: |
CVE-2008-1154 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 03 2008 12:00AM |
| Updated: | Apr 03 2008 06:49PM |
| Credit: | VoIPshield Systems |
| Vulnerable: |
Cisco Unified Presence Server 6.0(1) Cisco Unified Presence Server 6.0 Cisco Unified Presence Server 1.0(3) Cisco Unified Presence Server 1.0(2) Cisco Unified Presence Server 1.0 Cisco Unified Presence Server 1.0 Cisco Unified Communications Manager 6.1(1a) Cisco Unified Communications Manager 6.1 Cisco Unified Communications Manager 6.0(1) Cisco Unified Communications Manager 6.0 (1a) Cisco Unified Communications Manager 6.0 Cisco Unified Communications Manager 5.1(3a) Cisco Unified Communications Manager 5.1(2b) Cisco Unified Communications Manager 5.1(2a) Cisco Unified Communications Manager 5.1(2) Cisco Unified Communications Manager 5.1(1) Cisco Unified Communication Manager Business Edition 0 Cisco Mobility Manager 2.0 Cisco Emergency Responder 2.0 |
| Not Vulnerable: | |
Discussion
Cisco Unified Communications Disaster Recovery Framework Remote Command Execution Vulnerability
Multiple Cisco Unified Communications products are prone to a remote command-execution vulnerability. This issue occurs in the Disaster Recovery Framework.
An attacker can exploit this issue to execute arbitrary commands with full administrative privileges.
The following products are affected:
Cisco Unified Communications Manager (CUCM) 5.x and 6.x
Cisco Unified Communications Manager Business Edition
Cisco Unified Presence 1.x and 6.x
Cisco Emergency Responder 2.x
Cisco Mobility Manager 2.x
Multiple Cisco Unified Communications products are prone to a remote command-execution vulnerability. This issue occurs in the Disaster Recovery Framework.
An attacker can exploit this issue to execute arbitrary commands with full administrative privileges.
The following products are affected:
Cisco Unified Communications Manager (CUCM) 5.x and 6.x
Cisco Unified Communications Manager Business Edition
Cisco Unified Presence 1.x and 6.x
Cisco Emergency Responder 2.x
Cisco Mobility Manager 2.x
Exploit / POC
Cisco Unified Communications Disaster Recovery Framework Remote Command Execution Vulnerability
An attacker can use readily available network utilities to exploit this issue.
An attacker can use readily available network utilities to exploit this issue.
Solution / Fix
Cisco Unified Communications Disaster Recovery Framework Remote Command Execution Vulnerability
Solution:
The vendor has released an advisory and fixes. Please see the referenced advisory for details.
Solution:
The vendor has released an advisory and fixes. Please see the referenced advisory for details.
References
Cisco Unified Communications Disaster Recovery Framework Remote Command Execution Vulnerability
References:
References:
- Cisco Applied Mitigation Bulletin: Identifying and Mitigating Exploitation (Cisco)
- Cisco Homepage (Cisco )
- Cisco Security Advisory: Cisco Unified Communications Disaster Recovery Framewor (Cisco Systems Product Security Incident Response Team
- Cisco Security Advisory: Cisco Unified Communications Disaster Recovery Framewor (Cisco)