Cisco Unified Videoconferencing Local Information Disclosure Vulnerability
BID:44936
Info
Cisco Unified Videoconferencing Local Information Disclosure Vulnerability
| Bugtraq ID: | 44936 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 17 2010 12:00AM |
| Updated: | Dec 06 2010 07:55PM |
| Credit: | Florent Daigniere |
| Vulnerable: |
Cisco Unified Videoconferencing 5230 System 0 Cisco Unified Videoconferencing 5115 System 0 Cisco Unified Videoconferencing 5110 System 0 Cisco Unified Videoconferencing 3545 System 0 Cisco Unified Videoconferencing 3527 Primary Rate Interface (PRI) Gate 0 Cisco Unified Videoconferencing 3522 Basic Rate Interfaces (BRI) Gatew 0 Cisco Unified Videoconferencing 3515 Multipoint Control Unit (MCU) 0 |
| Not Vulnerable: |
Cisco Unified Videoconferencing 5230 System 7.1.2.15 Cisco Unified Videoconferencing 5115 System 7.1.2.15 Cisco Unified Videoconferencing 5110 System 7.1.2.12 Cisco Unified Videoconferencing 3545 System 5.7.2 Cisco Unified Videoconferencing 3527 Primary Rate Interface (PRI) Gate 5.7.2 Cisco Unified Videoconferencing 3522 Basic Rate Interfaces (BRI) Gatew 5.7.2 Cisco Unified Videoconferencing 3515 Multipoint Control Unit (MCU) 5.7.2 |
Discussion
Cisco Unified Videoconferencing Local Information Disclosure Vulnerability
Cisco Unified Videoconferencing is prone to an information-disclosure vulnerability.
An attacker can exploit this issue to obtain sensitive information that may lead to further attacks.
This issue is being tracked by Cisco bug ID CSCti54052.
The following products are affected:
Cisco Unified Videoconferencing 5110 System
Cisco Unified Videoconferencing 5115 System
Cisco Unified Videoconferencing 5230 System
Cisco Unified Videoconferencing 3545 System
Cisco Unified Videoconferencing 3527 Primary Rate Interface (PRI) Gateway
Cisco Unified Videoconferencing 3522 Basic Rate Interfaces (BRI) Gateway
Cisco Unified Videoconferencing 3515 Multipoint Control Unit (MCU)
NOTE: This issue was previously discussed in BID 44908 (Cisco Unified Videoconferencing Multiple Vulnerabilities and Weakness) but has been given its own record to better document it.
Cisco Unified Videoconferencing is prone to an information-disclosure vulnerability.
An attacker can exploit this issue to obtain sensitive information that may lead to further attacks.
This issue is being tracked by Cisco bug ID CSCti54052.
The following products are affected:
Cisco Unified Videoconferencing 5110 System
Cisco Unified Videoconferencing 5115 System
Cisco Unified Videoconferencing 5230 System
Cisco Unified Videoconferencing 3545 System
Cisco Unified Videoconferencing 3527 Primary Rate Interface (PRI) Gateway
Cisco Unified Videoconferencing 3522 Basic Rate Interfaces (BRI) Gateway
Cisco Unified Videoconferencing 3515 Multipoint Control Unit (MCU)
NOTE: This issue was previously discussed in BID 44908 (Cisco Unified Videoconferencing Multiple Vulnerabilities and Weakness) but has been given its own record to better document it.
Exploit / POC
Cisco Unified Videoconferencing Local Information Disclosure Vulnerability
Attackers can use standard, readily available tools to exploit this issue.
Attackers can use standard, readily available tools to exploit this issue.
Solution / Fix
Cisco Unified Videoconferencing Local Information Disclosure Vulnerability
Solution:
Updates are available. Please see the references for more information.
Solution:
Updates are available. Please see the references for more information.
References
Cisco Unified Videoconferencing Local Information Disclosure Vulnerability
References:
References:
- Cisco Unified Videoconferencing Homepage (Cisco)
- Cisco Security Response: Multiple Vulnerabilities in Cisco Unified Videoconferen (Cisco)
- Cisco Unified Videoconferencing multiple vulnerabilities - CVE-2010-3037 CVE-20 (Florent Daigniere
- Cisco Security Advisory: Multiple Vulnerabilities in Cisco Unified Videoconferen (Cisco)
- Multiple Vulnerabilities in Cisco Unified Videoconferencing Products (Cisco)