ID

VAR-200810-0357

CVE

CVE-2008-4543

TITLE

Cisco Unity Service disruption in (DoS) Vulnerabilities

DESCRIPTION

Cisco Unity 4.x before 4.2(1)ES161, 5.x before 5.0(1)ES53, and 7.x before 7.0(2)ES8, when using anonymous authentication (aka native Unity authentication), allows remote attackers to cause a denial of service (session exhaustion) via a large number of connections. Cisco Unity is prone to multiple remote vulnerabilities, including: - An information-disclosure vulnerability in the web interface - A denial-of-service vulnerability in the administration interface - A script-injection vulnerability in the web interface - Multiple denial-of-service vulnerabilities in unspecified services These issues are reported in Cisco Unity 7.0; other versions may also be affected. Cisco Unity is a voice and unified messaging platform. ---------------------------------------------------------------------- Do you need accurate and reliable IDS / IPS / AV detection rules? Get in-depth vulnerability details: http://secunia.com/binary_analysis/sample_analysis/ ---------------------------------------------------------------------- TITLE: Cisco Unity Multiple Vulnerabilities SECUNIA ADVISORY ID: SA32187 VERIFY ADVISORY: http://secunia.com/advisories/32187/ CRITICAL: Less critical IMPACT: Security Bypass, Exposure of sensitive information, DoS WHERE: >From local network SOFTWARE: Cisco Unity 4.x http://secunia.com/advisories/product/4386/ Cisco Unity 5.x http://secunia.com/advisories/product/20082/ Cisco Unity 7.x http://secunia.com/advisories/product/20083/ DESCRIPTION: Some vulnerabilities and a security issue have been reported in Cisco Unity, which can be exploited by malicious, local users to disclose potentially sensitive information, and by malicious people to bypass certain security restrictions and cause a DoS (Denial of Service). 1) An error exists within the authentication process in the Cisco Unity server, which can be exploited to bypass the authentication mechanism and view or modify certain system configuration parameters. 2) An error in the session handling in the Cisco Unity server can be exploited to cause a DoS by exhausting all available sessions. Successful exploitation of these vulnerabilities requires that the Cisco Unity server is configured for anonymous authentication (not the default configuration). 3) A security issue is caused due to insecure permissions on "\CommServer\Reports", which can be exploited by domain users to disclose potentially sensitive information. SOLUTION: Update to version 4.0ES161, 5.0ES53, or 7.0ES8. http://tools.cisco.com/support/downloads/go/Redirect.x?mdfid=274246502 PROVIDED AND/OR DISCOVERED BY: VoIPshield Systems ORIGINAL ADVISORY: Cisco: http://www.cisco.com/warp/public/707/cisco-sa-20081008-unity.shtml http://www.cisco.com/warp/public/707/cisco-sr-20081008-unity.shtml VoIPshield: http://www.voipshield.com/research-details.php?id=126&s=1&threats_details=&threats_category=0&threats_vendor=0&limit=20&sort=discovered&sortby=DESC http://www.voipshield.com/research-details.php?id=128&s=1&threats_details=&threats_category=0&threats_vendor=0&limit=20&sort=discovered&sortby=DESC http://www.voipshield.com/research-details.php?id=130&s=1&threats_details=&threats_category=0&threats_vendor=0&limit=20&sort=discovered&sortby=DESC ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

resource management error

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

VoIPshield

SOURCES

LAST UPDATE DATE

2025-04-10T23:09:30.978000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE