PT-2007-5792 · Cisco · Cisco Callmanager+1

Publicado 2007-08-31 · Atualizado 2017-07-29 · CVE-2007-4634

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco CallManager and Unified Communications Manager (CUCM) versions prior to 3.3(5)sr2b Cisco CallManager and Unified Communications Manager (CUCM) versions 4.1 prior to 4.1(3)sr5 Cisco CallManager and Unified Communications Manager (CUCM) versions 4.2 prior to 4.2(3)sr2 Cisco CallManager and Unified Communications Manager (CUCM) versions 4.3 prior to 4.3(1)sr1

Description The issue allows remote attackers to execute arbitrary SQL commands via the lang variable to the (1) user or (2) admin logon page.

Recommendations For versions prior to 3.3(5)sr2b, update to version 3.3(5)sr2b or later. For versions 4.1 prior to 4.1(3)sr5, update to version 4.1(3)sr5 or later. For versions 4.2 prior to 4.2(3)sr2, update to version 4.2(3)sr2 or later. For versions 4.3 prior to 4.3(1)sr1, update to version 4.3(1)sr1 or later. As a temporary workaround, consider restricting access to the user and admin logon pages until a patch is available.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2007-4634

Produtos afetados

Cisco Callmanager

Cisco Unified Communications Manager

Referências · 8

• 🔥 https://exploit-db.com/exploits/30541 · Exploit
• 🔥 http://securityfocus.com/bid/25480 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36326 · Nota
• http://cisco.com/en/US/products/products_security_advisory09186a00808ae327.shtml · Aviso do Fabricante
• http://secunia.com/advisories/26641 · Aviso do Fabricante
• http://securitytracker.com/id?1018624 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-4634 · Nota de Segurança
• http://vupen.com/english/advisories/2007/3010 · Nota