Cisco Unity 7.0 Multiple Remote Vulnerabilities

Bugtraq ID:	31642
Class:	Unknown
CVE:	CVE-2008-4543 CVE-2008-4544 CVE-2008-4545 CVE-2008-3814
Remote:	Yes
Local:	No
Published:	Oct 08 2008 12:00AM
Updated:	Jul 05 2016 10:01PM
Credit:	VoIPshield Systems
Vulnerable:	Cisco Unity 7.0 ES8 Cisco Unity 7.0 Cisco Unity 5.0 ES53 Cisco Unity 4.0 ES161
Not Vulnerable:

Cisco Unity 7.0 Multiple Remote Vulnerabilities

Cisco Unity is prone to multiple remote vulnerabilities, including:

- An information-disclosure vulnerability in the web interface
- A denial-of-service vulnerability in the administration interface
- A script-injection vulnerability in the web interface
- Multiple denial-of-service vulnerabilities in unspecified services

These issues are reported in Cisco Unity 7.0; other versions may also be affected.

Cisco Unity 7.0 Multiple Remote Vulnerabilities

An attacker may exploit these issues using a web browser and commonly available network tools.

Cisco Unity 7.0 Multiple Remote Vulnerabilities

Solution:
Cisco has released fixes and an advisory for these issues. Please see the references for more information.

Cisco Unity 7.0 Multiple Remote Vulnerabilities

References:

• Cisco Homepage (Cisco)
  
• cisco-sr-20081008-unity: Cisco Security Response: VoIPshield Reported Vulnerabil (Cisco)
  
• Cisco Unity Multiple Denial of Service Vulnerabilities (VoIPshield Systems)
  
• Cisco Unity Reports Information Disclosure (VoIPshield Systems)
  
• Cisco Unity Session Exhaustion Denial of Service (VoIPshield Systems)
  
• Cisco Unity Stored Cross-Site Scripting Vulnerability (VoIPshield Systems)