Cisco Unified Communications Manager (CVE-2011-1607) Directory Traversal Vulnerability

Bugtraq ID:	47608
Class:	Input Validation Error
CVE:	CVE-2011-1607
Remote:	Yes
Local:	No
Published:	Apr 27 2011 12:00AM
Updated:	Apr 27 2011 12:00AM
Credit:	Cisco
Vulnerable:	Cisco Unified Communications Manager 8.5 Cisco Unified Communications Manager 8.0(3a)SU2 Cisco Unified Communications Manager 8.0(3a) Cisco Unified Communications Manager 8.0(3) Cisco Unified Communications Manager 8.0(2C)Su1 Cisco Unified Communications Manager 8.0(2C) Cisco Unified Communications Manager 8.0(1) Cisco Unified Communications Manager 8.0(0.98000.106) Cisco Unified Communications Manager 7.1(5b)SU2 Cisco Unified Communications Manager 7.1(5B) Cisco Unified Communications Manager 7.1(5A) Cisco Unified Communications Manager 7.1(5)Su1a Cisco Unified Communications Manager 7.1(5)Su1 Cisco Unified Communications Manager 7.1(5) Cisco Unified Communications Manager 7.1(3b)su2 Cisco Unified Communications Manager 7.1(3b)su1 Cisco Unified Communications Manager 7.1(3B) Cisco Unified Communications Manager 7.1(3A)Su1a Cisco Unified Communications Manager 7.1(3a)su1 Cisco Unified Communications Manager 7.1(3A) Cisco Unified Communications Manager 7.1(3) Cisco Unified Communications Manager 7.1(2B)Su1 Cisco Unified Communications Manager 7.1(2B) Cisco Unified Communications Manager 7.1(2a)su1 Cisco Unified Communications Manager 7.1(2A) Cisco Unified Communications Manager 7.1(2) Cisco Unified Communications Manager 7.1 Cisco Unified Communications Manager 7.0(3g) Cisco Unified Communications Manager 7.0(2a)SU3 Cisco Unified Communications Manager 7.0(2a)SU3 Cisco Unified Communications Manager 7.0(2A)Su2 Cisco Unified Communications Manager 7.0(2a)su1 Cisco Unified Communications Manager 7.0(2A) Cisco Unified Communications Manager 7.0(2) Cisco Unified Communications Manager 7.0(1)Su1a Cisco Unified Communications Manager 7.0(1)Su1 Cisco Unified Communications Manager 7.0 Cisco Unified Communications Manager 6.1(5)SU2 Cisco Unified Communications Manager 6.1(5)SU1 Cisco Unified Communications Manager 6.1(5) Cisco Unified Communications Manager 6.1(4A)Su2 Cisco Unified Communications Manager 6.1(4A) Cisco Unified Communications Manager 6.1(4)Su1 Cisco Unified Communications Manager 6.1(4) Cisco Unified Communications Manager 6.1(3B) Cisco Unified Communications Manager 6.1(3A) Cisco Unified Communications Manager 6.1(3) Cisco Unified Communications Manager 6.1(2)Su1a Cisco Unified Communications Manager 6.1(2) Cisco Unified Communications Manager 6.1(1B) Cisco Unified Communications Manager 6.1(1a) Cisco Unified Communications Manager 6.1(1) Cisco Unified Communications Manager 6.1 (3b)su1 Cisco Unified Communications Manager 6.1 (2)su1 Cisco Unified Communications Manager 6.1 Cisco Unified Communications Manager 6.0(1) Cisco Unified Communications Manager 6.0 (1a)
Not Vulnerable:	Cisco Unified Communications Manager 8.5(1) Cisco Unified Communications Manager 8.0(3a)su1 Cisco Unified Communications Manager 7.1(5b)su3 Cisco Unified Communications Manager 6.1(5)SU3

Cisco Unified Communications Manager (CVE-2011-1607) Directory Traversal Vulnerability

Cisco Unified Communications Manager is prone to a directory-traversal vulnerability.

Exploiting this issue will allow an attacker to write arbitrary files to locations outside of the application's current directory. This could help the attacker launch further attacks.

This issue is tracked by Cisco BugID CSCti81603.

Cisco Unified Communications Manager (CVE-2011-1607) Directory Traversal Vulnerability

An attacker can exploit this issue through a browser.

Cisco Unified Communications Manager (CVE-2011-1607) Directory Traversal Vulnerability

Solution:
Vendor updates are available. Please see the references for details.

Cisco Unified Communications Manager (CVE-2011-1607) Directory Traversal Vulnerability

References:

• Cisco Homepage (Cisco)
  
• Cisco Security Advisory: Multiple Vulnerabilities in Cisco Unified Communication (Cisco)