PT-2009-2266 · Microsoft+1 · Exchange Server+1

Published 2009-05-07 · Updated 2009-05-08 · CVE-2008-6797

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Mitel NuPoint Messenger versions R11 and R3

Description: The issue concerns the server in Mitel NuPoint Messenger sending usernames and passwords in cleartext to Exchange servers. This allows remote attackers to obtain sensitive information by sniffing the network.

Recommendations: For versions R11 and R3, consider configuring the server to use encrypted communication with Exchange servers to protect sensitive information. As a temporary workaround, restrict access to the network to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2008-6797

Affected Products

Exchange Server

Mitel Nupoint Messenger

References · 4

• http://mitel.com/resources/NuPoint_and_Exchange.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-6797 · Security Note
• http://securityfocus.com/bid/34847 · Note
• http://kb.cert.org/vuls/id/576996 · Note