Cisco Unified Contact Center Express Bootstrap Service Directory Traversal Vulnerability

Bugtraq ID:	40680
Class:	Input Validation Error
CVE:	CVE-2010-1571
Remote:	Yes
Local:	No
Published:	Jun 09 2010 12:00AM
Updated:	Jun 09 2010 12:00AM
Credit:	This issue was reported to Cisco by a customer.
Vulnerable:	Cisco Unified IP Interactive Voice Response 7.x Cisco Unified IP Interactive Voice Response 6.x Cisco Unified IP Interactive Voice Response 5.x Cisco Unified Contact Center Express (CCX) 7.x Cisco Unified Contact Center Express (CCX) 6.x Cisco Unified Contact Center Express (CCX) 5.x Cisco Customer Response Solution (CRS) 7.x Cisco Customer Response Solution (CRS) 6.x Cisco Customer Response Solution (CRS) 5.x
Not Vulnerable:	Cisco Unified Contact Center Express (CCX) 7.0(2) Cisco Unified Contact Center Express (CCX) 7.0(1)SR2 Cisco Unified Contact Center Express (CCX) 5.0(2)SR3

Cisco Unified Contact Center Express Bootstrap Service Directory Traversal Vulnerability

Cisco Unified Contact Center Express is prone to a directory-traversal vulnerability.

An attacker can exploit this issue to view any file on the computer through the bootstrap service. Successful exploits may lead to other attacks.

This issue is tracked by Cisco BugID CSCsx76165.

Cisco Unified Contact Center Express Bootstrap Service Directory Traversal Vulnerability

An attacker can exploit this issue with readily available tools.

Cisco Unified Contact Center Express Bootstrap Service Directory Traversal Vulnerability

Solution:
Updates are available; please see the references for more information.

Cisco Unified Contact Center Express Bootstrap Service Directory Traversal Vulnerability

References:

• Cisco Homepage (Cisco)
  
• Cisco Security Advisory: Vulnerabilities in Cisco Unified Contact Center Express (Cisco)