PT-2010-5410 · Cisco+1 · Cisco Unified Videoconferencing (Uvc) System+1

Published 2010-11-22 · Updated 2010-11-30 · CVE-2010-4302

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:L/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Unified Videoconferencing (UVC) System versions 5110 and 5115

Description The issue concerns the use of a weak hashing algorithm for administrator and operator passwords in the Cisco Unified Videoconferencing (UVC) System when the Linux operating system is used. This weakness makes it easier for local users to obtain sensitive information by recovering the cleartext values of the passwords.

Recommendations For Cisco Unified Videoconferencing (UVC) System versions 5110 and 5115, consider changing the administrator and operator passwords to strong, unique values and avoid using the Mcu.val file for password storage until a stronger hashing algorithm is implemented. As a temporary workaround, restrict local access to the system to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2010-4302

Affected Products

Cisco Unified Videoconferencing (Uvc) System

Linux

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2010-4302 · Security Note
• http://cisco.com/en/US/products/products_security_response09186a0080b56d0d.html · Vendor Advisory
• http://trustmatta.com/advisories/MATTA-2010-001.txt · Note
• http://seclists.org/fulldisclosure/2010/Nov/167 · Note