Cisco Unified Communications Manager Command-line Utility Local Security Bypass Vulnerability

Bugtraq ID:	63731
Class:	Input Validation Error
CVE:	CVE-2013-6689
Remote:	No
Local:	Yes
Published:	Nov 13 2013 12:00AM
Updated:	Nov 13 2013 12:00AM
Credit:	Cisco
Vulnerable:	Cisco Unified Communications Manager 9.1.2 Cisco Unified Communications Manager 9.1(1) Cisco Unified Communications Manager 9.1
Not Vulnerable:

Cisco Unified Communications Manager Command-line Utility Local Security Bypass Vulnerability

Cisco Unified Communications Manager is prone to a local security bypass vulnerability because it fails to sanitize user-supplied input.

Local attacker can exploit this issue to read or write arbitrary files on the filesystem. Successful exploits will result in the complete compromise of the affected computers.

This issue is being tracked by Cisco Bug ID CSCui58229.

Cisco Unified Communications Manager Command-line Utility Local Security Bypass Vulnerability

Reportedly the proof-of-concept code is available. The exploit is otherwise not publicly available.

Cisco Unified Communications Manager Command-line Utility Local Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Cisco Unified Communications Manager Command-line Utility Local Security Bypass Vulnerability

References:

• Cisco Homepage (Cisco )
  
• Cisco Unified Communications Manager Arbitrary File Read/Write Vulnerability (Cisco)
  
• Cisco Unified Communications Manager Arbitrary File Read/Write Vulnerability (Cisco)