Cisco Unified IP Phone 8900/9900 Series Insecure File Permissions Privilege Escalation Vulnerability

Bugtraq ID:	63687
Class:	Design Error
CVE:	CVE-2013-6685
Remote:	No
Local:	Yes
Published:	Nov 12 2013 12:00AM
Updated:	Nov 15 2013 12:33AM
Credit:	Cisco
Vulnerable:
Not Vulnerable:

Cisco Unified IP Phone 8900/9900 Series Insecure File Permissions Privilege Escalation Vulnerability

Cisco Unified IP Phone 8900/9900 series are prone to a security vulnerability because it creates files with insecure permissions.

An attacker with local access could potentially exploit this issue to gain escalated privileges. Successful exploits will completely compromise the affected device.

This issue is tracked by Cisco Bug ID CSCui04382.

Cisco Unified IP Phone 9951, 9971, and 8961 series are vulnerable.

Cisco Unified IP Phone 8900/9900 Series Insecure File Permissions Privilege Escalation Vulnerability

An attacker can exploit this issue using readily available commands.

Cisco Unified IP Phone 8900/9900 Series Insecure File Permissions Privilege Escalation Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Cisco Unified IP Phone 8900/9900 Series Insecure File Permissions Privilege Escalation Vulnerability

References:

• Cisco Homepage (Cisco )