PT-2004-1969 · Mitel · Mitel 3300 Icp

Published 2004-02-28 · Updated 2008-09-05 · CVE-2004-0944

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Mitel 3300 Integrated Communications Platform (ICP) versions prior to 4.2.2.11

Description: The issue allows remote attackers to hijack other sessions due to easily predictable web session IDs generated by the web management interface. This can be achieved via the parentsessionid cookie.

Recommendations: For versions prior to 4.2.2.11, update to version 4.2.2.11 or later to resolve the issue. As a temporary workaround, consider restricting access to the web management interface to minimize the risk of session hijacking.

Fix

Related Identifiers

CVE-2004-0944

Affected Products

Mitel 3300 Icp

References · 4

• http://niscc.gov.uk/niscc/docs/re-20050228-00178.pdf?lang=en · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0944 · Security Note
• http://corsaire.com/advisories/c040817-002.txt · Vendor Advisory
• http://mitel.com/DocController?documentId=14223 · Vendor Advisory