RETIRED: Cisco Unified Videoconferencing Multiple Vulnerabilities and Weakness
BID:44908
Info
RETIRED: Cisco Unified Videoconferencing Multiple Vulnerabilities and Weakness
| Bugtraq ID: | 44908 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 17 2010 12:00AM |
| Updated: | Nov 18 2010 04:16PM |
| Credit: | Florent Daigniere, Cisco |
| Vulnerable: |
Cisco Unified Videoconferencing 5230 System 0 Cisco Unified Videoconferencing 5115 System 0 Cisco Unified Videoconferencing 5110 System 0 Cisco Unified Videoconferencing 3545 System 0 Cisco Unified Videoconferencing 3527 Primary Rate Interface (PRI) Gate 0 Cisco Unified Videoconferencing 3522 Basic Rate Interfaces (BRI) Gatew 0 Cisco Unified Videoconferencing 3515 Multipoint Control Unit (MCU) 0 |
| Not Vulnerable: | |
Discussion
RETIRED: Cisco Unified Videoconferencing Multiple Vulnerabilities and Weakness
Cisco Unified Videoconferencing is prone to multiple remote vulnerabilities and a weakness.
An attacker can exploit these issue to gain unauthorized access to the affected device, gain access to sensitive information, compromise the affected device, and hijack a user's session. Other attacks are also possible.
The following products are affected:
Cisco Unified Videoconferencing 5110 System
Cisco Unified Videoconferencing 5115 System
Cisco Unified Videoconferencing 5230 System
Cisco Unified Videoconferencing 3545 System
Cisco Unified Videoconferencing 3527 Primary Rate Interface (PRI) Gateway
Cisco Unified Videoconferencing 3522 Basic Rate Interfaces (BRI) Gateway
Cisco Unified Videoconferencing 3515 Multipoint Control Unit (MCU)
This BID is being retired. The following individual records exist to better document the issues:
44922 Cisco Unified Videoconferencing Multiple Remote Command Injection Vulnerabilities
44923 Cisco Unified Videoconferencing Password Obfuscation Vulnerability
44924 Cisco Unified Videoconferencing Hardcoded User Credentials Authentication Bypass Vulnerability
44925 Cisco Unified Videoconferencing Security Bypass Vulnerability
44926 Cisco Unified Videoconferencing Web Interface Weak Session Cookie Session Hijacking Vulnerability
44927 Cisco Unified Videoconferencing Local Information Disclosure Vulnerability
44928 Cisco Unified Videoconferencing FTP Server Security Weakness
44929 Cisco Unified Videoconferencing Security Bypass Vulnerability
44936 Cisco Unified Videoconferencing Local Information Disclosure Vulnerability
Cisco Unified Videoconferencing is prone to multiple remote vulnerabilities and a weakness.
An attacker can exploit these issue to gain unauthorized access to the affected device, gain access to sensitive information, compromise the affected device, and hijack a user's session. Other attacks are also possible.
The following products are affected:
Cisco Unified Videoconferencing 5110 System
Cisco Unified Videoconferencing 5115 System
Cisco Unified Videoconferencing 5230 System
Cisco Unified Videoconferencing 3545 System
Cisco Unified Videoconferencing 3527 Primary Rate Interface (PRI) Gateway
Cisco Unified Videoconferencing 3522 Basic Rate Interfaces (BRI) Gateway
Cisco Unified Videoconferencing 3515 Multipoint Control Unit (MCU)
This BID is being retired. The following individual records exist to better document the issues:
44922 Cisco Unified Videoconferencing Multiple Remote Command Injection Vulnerabilities
44923 Cisco Unified Videoconferencing Password Obfuscation Vulnerability
44924 Cisco Unified Videoconferencing Hardcoded User Credentials Authentication Bypass Vulnerability
44925 Cisco Unified Videoconferencing Security Bypass Vulnerability
44926 Cisco Unified Videoconferencing Web Interface Weak Session Cookie Session Hijacking Vulnerability
44927 Cisco Unified Videoconferencing Local Information Disclosure Vulnerability
44928 Cisco Unified Videoconferencing FTP Server Security Weakness
44929 Cisco Unified Videoconferencing Security Bypass Vulnerability
44936 Cisco Unified Videoconferencing Local Information Disclosure Vulnerability
Exploit / POC
RETIRED: Cisco Unified Videoconferencing Multiple Vulnerabilities and Weakness
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Note: Some of these issues may not require a specific exploit.
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Note: Some of these issues may not require a specific exploit.
Solution / Fix
RETIRED: Cisco Unified Videoconferencing Multiple Vulnerabilities and Weakness
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of any more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of any more recent information, please mail us at: [email protected].
References
RETIRED: Cisco Unified Videoconferencing Multiple Vulnerabilities and Weakness
References:
References:
- Cisco Unified Videoconferencing Homepage (Cisco)
- Cisco Security Response: Multiple Vulnerabilities in Cisco Unified Videoconferen (Cisco)
- Cisco Unified Videoconferencing multiple vulnerabilities - CVE-2010-3037 CVE-20 (Florent Daigniere
- Multiple Vulnerabilities in Cisco Unified Videoconferencing Products (Cisco)