Cisco Unified Communications Manager PAB Synchronizer Privilege Escalation Vulnerability

Bugtraq ID:	34082
Class:	Design Error
CVE:	CVE-2009-0632
Remote:	Yes
Local:	No
Published:	Mar 11 2009 12:00AM
Updated:	Mar 11 2009 10:06PM
Credit:	Reported by the vendor
Vulnerable:	Cisco Unified Communications Manager 7.0 Cisco Unified Communications Manager 6.1(3) Cisco Unified Communications Manager 6.1(2) Cisco Unified Communications Manager 6.1(1a) Cisco Unified Communications Manager 6.1(1) Cisco Unified Communications Manager 6.1 (2)su1 Cisco Unified Communications Manager 6.1 Cisco Unified Communications Manager 6.0(1) Cisco Unified Communications Manager 6.0 (1a) Cisco Unified Communications Manager 6.0 Cisco Unified Communications Manager 5.1(3d) Cisco Unified Communications Manager 5.1(3C) Cisco Unified Communications Manager 5.1(3a) Cisco Unified Communications Manager 5.1(3) Cisco Unified Communications Manager 5.1(2b) Cisco Unified Communications Manager 5.1(2a) Cisco Unified Communications Manager 5.1(2) Cisco Unified Communications Manager 5.1(1) Cisco Unified Communications Manager 5.0 Cisco Unified Communications Manager 4.3(2)SR1 Cisco Unified Communications Manager 4.3(2) Cisco Unified Communications Manager 4.3(1)Sr.1 Cisco Unified Communications Manager 4.3 Cisco Unified Communications Manager 4.2(3)sr2 Cisco Unified Communications Manager 4.2 (3)SR4 Cisco Unified Communications Manager 4.2 (3)SR3 Cisco Unified Communications Manager 4.2 (3)SR2b
Not Vulnerable:	Cisco Unified Communications Manager 7.0(2) Cisco Unified Communications Manager 6.1(3) Cisco Unified Communications Manager 5.1(3e) Cisco Unified Communications Manager 4.3(2)Sr1b Cisco Unified Communications Manager 4.2(3)SR4b

Cisco Unified Communications Manager PAB Synchronizer Privilege Escalation Vulnerability

Cisco Unified Communications Manager is prone to a remote privilege-escalation vulnerability.

Attackers can exploit this issue to gain administrative access to the affected device and completely compromise it.

This issue is tracked by Cisco Bug ID CSCso76587 and CSCso78528.

Cisco Unified Communications Manager PAB Synchronizer Privilege Escalation Vulnerability

To exploit this issue, attackers can use readily available network utilities.

Cisco Unified Communications Manager PAB Synchronizer Privilege Escalation Vulnerability

Solution:
The vendor has released updates. Please see the referenced advisory for details.

Cisco Unified Communications Manager PAB Synchronizer Privilege Escalation Vulnerability

References:

• Cisco Applied Mitigation Bulletin: Identifying and Mitigating Exploitation of th (Cisco)
  
• Cisco Security Advisory: Cisco Unified Communications Manager IP Phone Personal (Cisco)
  
• Cisco Unified Communication Manager Homepage (Cisco)