BID:9189

Cisco Unity Default User Accounts and IP Addresses Multiple Vulnerabilities

Info

Cisco Unity Default User Accounts and IP Addresses Multiple Vulnerabilities

Bugtraq ID:	9189
Class:	Configuration Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 10 2003 12:00AM
Updated:	Dec 10 2003 12:00AM
Credit:	Announced by the vendor.
Vulnerable:	Cisco 80-7112-01 for the UNITY-SVRX255-2A + Cisco Unity Server 4.0 + Cisco Unity Server 3.3 + Cisco Unity Server 3.2 + Cisco Unity Server 3.1 + Cisco Unity Server 3.0 + Cisco Unity Server 2.46 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.1 + Cisco Unity Server 2.0 + Cisco Unity Server Cisco 80-7111-01 for the UNITY-SVRX255-1A + Cisco Unity Server 4.0 + Cisco Unity Server 3.3 + Cisco Unity Server 3.2 + Cisco Unity Server 3.1 + Cisco Unity Server 3.0 + Cisco Unity Server 2.46 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.1 + Cisco Unity Server 2.0 + Cisco Unity Server

Not Vulnerable:	Cisco 80-7243-01 for the MCS-7815i-2.0-ECS1 + Cisco Unity Server 4.0 + Cisco Unity Server 3.3 + Cisco Unity Server 3.2 + Cisco Unity Server 3.1 + Cisco Unity Server 3.0 + Cisco Unity Server 2.46 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.1 + Cisco Unity Server 2.0 + Cisco Unity Server Cisco 80-7242-01 for the MCS-7835i-2.4-ECS1 + Cisco Unity Server 4.0 + Cisco Unity Server 3.3 + Cisco Unity Server 3.2 + Cisco Unity Server 3.1 + Cisco Unity Server 3.0 + Cisco Unity Server 2.46 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.1 + Cisco Unity Server 2.0 + Cisco Unity Server Cisco 80-7241-01 for the MCS-7845i-2.4-ECS1 + Cisco Unity Server 4.0 + Cisco Unity Server 3.3 + Cisco Unity Server 3.2 + Cisco Unity Server 3.1 + Cisco Unity Server 3.0 + Cisco Unity Server 2.46 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.1 + Cisco Unity Server 2.0 + Cisco Unity Server Cisco 80-7240-01 for the MCS-7845i-2.4-ECS2 + Cisco Unity Server 4.0 + Cisco Unity Server 3.3 + Cisco Unity Server 3.2 + Cisco Unity Server 3.1 + Cisco Unity Server 3.0 + Cisco Unity Server 2.46 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.1 + Cisco Unity Server 2.0 + Cisco Unity Server Cisco 80-7237-01 plus 80-7239-01 for the MCS-7865i-1.5-E + Cisco Unity Server 4.0 + Cisco Unity Server 3.3 + Cisco Unity Server 3.2 + Cisco Unity Server 3.1 + Cisco Unity Server 3.0 + Cisco Unity Server 2.46 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.1 + Cisco Unity Server 2.0 + Cisco Unity Server Cisco 80-7237-01 plus 80-7239-01 for the MCS-7855i-1.5-E + Cisco Unity Server 4.0 + Cisco Unity Server 3.3 + Cisco Unity Server 3.2 + Cisco Unity Server 3.1 + Cisco Unity Server 3.0 + Cisco Unity Server 2.46 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.1 + Cisco Unity Server 2.0 + Cisco Unity Server Cisco 80-7236-01 plus 80-7238-01 for the MCS-7865i-1.5-E + Cisco Unity Server 4.0 + Cisco Unity Server 3.3 + Cisco Unity Server 3.2 + Cisco Unity Server 3.1 + Cisco Unity Server 3.0 + Cisco Unity Server 2.46 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.1 + Cisco Unity Server 2.0 + Cisco Unity Server Cisco 80-7236-01 plus 80-7238-01 for the MCS-7855i-1.5-E + Cisco Unity Server 4.0 + Cisco Unity Server 3.3 + Cisco Unity Server 3.2 + Cisco Unity Server 3.1 + Cisco Unity Server 3.0 + Cisco Unity Server 2.46 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.1 + Cisco Unity Server 2.0 + Cisco Unity Server Cisco 80-7110-02 for the UNITY-SVRX345-2A + Cisco Unity Server 4.0 + Cisco Unity Server 3.3 + Cisco Unity Server 3.2 + Cisco Unity Server 3.1 + Cisco Unity Server 3.0 + Cisco Unity Server 2.46 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.1 + Cisco Unity Server 2.0 + Cisco Unity Server Cisco 80-7110-01 for the UNITY-SVRX345-2A + Cisco Unity Server 4.0 + Cisco Unity Server 3.3 + Cisco Unity Server 3.2 + Cisco Unity Server 3.1 + Cisco Unity Server 3.0 + Cisco Unity Server 2.46 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.1 + Cisco Unity Server 2.0 + Cisco Unity Server Cisco 80-7109-02 for the UNITY-SVRX345-1A + Cisco Unity Server 4.0 + Cisco Unity Server 3.3 + Cisco Unity Server 3.2 + Cisco Unity Server 3.1 + Cisco Unity Server 3.0 + Cisco Unity Server 2.46 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.1 + Cisco Unity Server 2.0 + Cisco Unity Server Cisco 80-7109-01 for the UNITY-SVRX345-1A + Cisco Unity Server 4.0 + Cisco Unity Server 3.3 + Cisco Unity Server 3.2 + Cisco Unity Server 3.1 + Cisco Unity Server 3.0 + Cisco Unity Server 2.46 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.1 + Cisco Unity Server 2.0 + Cisco Unity Server Cisco 80-7108-02 for the UNITY-SVRX205-1A + Cisco Unity Server 4.0 + Cisco Unity Server 3.3 + Cisco Unity Server 3.2 + Cisco Unity Server 3.1 + Cisco Unity Server 3.0 + Cisco Unity Server 2.46 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.1 + Cisco Unity Server 2.0 + Cisco Unity Server Cisco 80-7108-01 for the UNITY-SVRX205-1A + Cisco Unity Server 4.0 + Cisco Unity Server 3.3 + Cisco Unity Server 3.2 + Cisco Unity Server 3.1 + Cisco Unity Server 3.0 + Cisco Unity Server 2.46 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.1 + Cisco Unity Server 2.0 + Cisco Unity Server Cisco 80-7003-01 for the UNITY-SVRX255-1A and UNITY-SVRX + Cisco Unity Server 4.0 + Cisco Unity Server 3.3 + Cisco Unity Server 3.2 + Cisco Unity Server 3.1 + Cisco Unity Server 3.0 + Cisco Unity Server 2.46 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.1 + Cisco Unity Server 2.0 + Cisco Unity Server Cisco 80-7002-01 for the UNITY-SVRX255-1A and UNITY-SVRX + Cisco Unity Server 4.0 + Cisco Unity Server 3.3 + Cisco Unity Server 3.2 + Cisco Unity Server 3.1 + Cisco Unity Server 3.0 + Cisco Unity Server 2.46 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.1 + Cisco Unity Server 2.0 + Cisco Unity Server Cisco 80-6765-01 for the UNITY-SVRX232-2A + Cisco Unity Server 4.0 + Cisco Unity Server 3.3 + Cisco Unity Server 3.2 + Cisco Unity Server 3.1 + Cisco Unity Server 3.0 + Cisco Unity Server 2.46 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.1 + Cisco Unity Server 2.0 + Cisco Unity Server Cisco 80-6750-01 for the Unity SVRX232-1A + Cisco Unity Server 4.0 + Cisco Unity Server 3.3 + Cisco Unity Server 3.2 + Cisco Unity Server 3.1 + Cisco Unity Server 3.0 + Cisco Unity Server 2.46 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.1 + Cisco Unity Server 2.0 + Cisco Unity Server

Discussion

Cisco Unity Default User Accounts and IP Addresses Multiple Vulnerabilities

Multiple vulnerabilities have been identified in Cisco Unity running on IBM servers. It has been reported that vulnerable systems contain default user accounts and default IP addresses that could be used by an attacker to gain unauthorized access.

Exploit / POC

Cisco Unity Default User Accounts and IP Addresses Multiple Vulnerabilities

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Solution / Fix

Cisco Unity Default User Accounts and IP Addresses Multiple Vulnerabilities

Solution:
Cisco has stated that a software fix is not necessary for these issues. See the Workarounds section for procedures to change the software configuration to eliminate these issues.

References

Cisco Unity Default User Accounts and IP Addresses Multiple Vulnerabilities

References:

Cisco Security Advisory: Unity Vulnerabilities on IBM-based Servers (Cisco)