PT-2008-2748 · Cisco · Cisco Unified Presence+3

Published 2008-04-04 · Updated 2017-08-08 · CVE-2008-1154

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager versions 5.x through 6.x Cisco Unified Presence versions 1.x through 6.x Cisco Emergency Responder version 2.x Cisco Mobility Manager version 2.x

Description The issue concerns the Disaster Recovery Framework master server in Cisco Unified Communications products. It does not require authentication for requests received from the network, allowing remote attackers to execute arbitrary code.

Recommendations For Cisco Unified Communications Manager versions 5.x through 6.x, update to a version that requires authentication for requests. For Cisco Unified Presence versions 1.x through 6.x, update to a version that requires authentication for requests. For Cisco Emergency Responder version 2.x, update to a version that requires authentication for requests. For Cisco Mobility Manager version 2.x, update to a version that requires authentication for requests.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2008-1154

Affected Products

Cisco Emergency Responder

Cisco Mobility Manager

Cisco Unified Communications Manager

Cisco Unified Presence

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2008-1154 · Security Note
• http://securitytracker.com/id?1019768 · Note
• http://vupen.com/english/advisories/2008/1093 · Note
• http://cisco.com/en/US/products/products_security_advisory09186a008096fd9a.shtml · Patch, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41632 · Note
• http://securityfocus.com/bid/28591 · Note
• http://secunia.com/advisories/29670 · Note