PT-2018-8668 · Cisco · Cisco Unity Connection

Published 2018-02-22 · Updated 2019-10-09 · CVE-2018-0203

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: Cisco Unity Connection (affected versions not specified)

Description: A vulnerability in the SMTP relay could allow an unauthenticated, remote attacker to send unsolicited email messages. This issue is due to improper handling of domain information in the affected software. An attacker could exploit this by sending crafted requests to the targeted application, potentially allowing them to send email messages to arbitrary addresses.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

NULL Pointer Dereference

Weakness Enumeration

CWE-19

CWE-476

Related Identifiers

BDU:2019-02929

CVE-2018-0203

Affected Products

Cisco Unity Connection

References · 10

• https://debian.org/security/2019/dsa-4490.ru.html · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180221-cuc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-0203 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2018-0203 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-02929 · Security Note
• https://subversion.apache.org/security/CVE-2019-0203-advisory.txt · Note
• http://securitytracker.com/id/1040413 · Note
• http://securityfocus.com/bid/103142 · Note
• https://access.redhat.com/security/cve/cve-2019-0203 · Note
• https://web-material3.yokogawa.com/1/32463/files/YSAR-22-0004-E.pdf · Note