Cisco Unified Communications Manager Invalid Argument Privilege Escalation Vulnerability

Bugtraq ID:	44672
Class:	Design Error
CVE:	CVE-2010-3039
Remote:	No
Local:	Yes
Published:	Nov 03 2010 12:00AM
Updated:	Nov 03 2010 12:00AM
Credit:	Knud Erik Hjgaard of nSense
Vulnerable:	Cisco Unified Communications Manager 9.0(1) Cisco Unified Communications Manager 8.0(3a) Cisco Unified Communications Manager 8.0(3) Cisco Unified Communications Manager 8.0(2C)Su1 Cisco Unified Communications Manager 8.0(2C) Cisco Unified Communications Manager 8.0(0.98000.106) Cisco Unified Communications Manager 7.1(5b)SU2 Cisco Unified Communications Manager 7.1(5B) Cisco Unified Communications Manager 7.1(5A) Cisco Unified Communications Manager 7.1(5)Su1a Cisco Unified Communications Manager 7.1(5)Su1 Cisco Unified Communications Manager 7.1(5) Cisco Unified Communications Manager 7.1(3b)su2 Cisco Unified Communications Manager 7.1(3b)su1 Cisco Unified Communications Manager 7.1(3B) Cisco Unified Communications Manager 7.1(3A)Su1a Cisco Unified Communications Manager 7.1(3a)su1 Cisco Unified Communications Manager 7.1(3A) Cisco Unified Communications Manager 7.1(3) Cisco Unified Communications Manager 7.1(2B)Su1 Cisco Unified Communications Manager 7.1(2B) Cisco Unified Communications Manager 7.1(2a)su1 Cisco Unified Communications Manager 7.1(2A) Cisco Unified Communications Manager 7.1(2) Cisco Unified Communications Manager 7.1 Cisco Unified Communications Manager 7.0(3g) Cisco Unified Communications Manager 7.0(2a)SU3 Cisco Unified Communications Manager 7.0(2a)SU3 Cisco Unified Communications Manager 7.0(2A)Su2 Cisco Unified Communications Manager 7.0(2a)su1 Cisco Unified Communications Manager 7.0(2A) Cisco Unified Communications Manager 7.0(2) Cisco Unified Communications Manager 7.0(1)Su1a Cisco Unified Communications Manager 7.0(1)Su1 Cisco Unified Communications Manager 7.0 Cisco Unified Communications Manager 6.1(5)SU2 Cisco Unified Communications Manager 6.1(5)SU1 Cisco Unified Communications Manager 6.1(5) Cisco Unified Communications Manager 6.1(4A)Su2 Cisco Unified Communications Manager 6.1(4A) Cisco Unified Communications Manager 6.1(4)Su1 Cisco Unified Communications Manager 6.1(4) Cisco Unified Communications Manager 6.1(3B) Cisco Unified Communications Manager 6.1(3A) Cisco Unified Communications Manager 6.1(3) Cisco Unified Communications Manager 6.1(2)Su1a Cisco Unified Communications Manager 6.1(2) Cisco Unified Communications Manager 6.1(1B) Cisco Unified Communications Manager 6.1(1a) Cisco Unified Communications Manager 6.1(1) Cisco Unified Communications Manager 6.1 (3b)su1 Cisco Unified Communications Manager 6.1 (2)su1 Cisco Unified Communications Manager 6.1 Cisco Unified Communications Manager 6.0(1) Cisco Unified Communications Manager 6.0 (1a)
Not Vulnerable:

Cisco Unified Communications Manager Invalid Argument Privilege Escalation Vulnerability

Cisco Unified Communications Manager is prone to a local privilege-escalation vulnerability.

Attackers can exploit this issue to gain administrative access to the affected device and execute arbitrary code with superuser privileges. Successful exploits will lead to the complete compromise of the device.

This issue is tracked by Cisco Bug ID CSCti52041 and CSCti74930.

Cisco Unified Communications Manager 6, 7, and 8 are vulnerable.

Cisco Unified Communications Manager Invalid Argument Privilege Escalation Vulnerability

Solution:
The vendor has released updates. Please see the referenced advisory for details.