The OpenNET Project
 
Search (keywords):  SOFT ARTICLES TIPS & TRICKS SECURITY
LINKS NEWS MAN DOCUMENTATION


[NEWS] Cisco Unity Express Privilege Escalation


<< Previous INDEX Search src / Print Next >>
From: SecuriTeam <support@securiteam.com.>
To: [email protected]
Date: 2 May 2006 11:06:32 +0200
Subject: [NEWS] Cisco Unity Express Privilege Escalation
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-Id: <20060502085309.44CE4581B@mail.tyumen.ru.>
X-Virus-Scanned: antivirus-gw at tyumen.ru

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -




  Cisco Unity Express Privilege Escalation
------------------------------------------------------------------------


SUMMARY

" <http://www.cisco.com/en/US/products/sw/voicesw/ps5520/index.html>; Cisco 
Unity Express enables small and medium-sized businesses (SMBs) and 
enterprise branch offices to cost-effectively integrate voice mail and 
auto attendant services inside Cisco routers for a lower total cost of 
ownership and increased employee productivity."

Improper handling of user authentication validation allows users to modify 
passwords for other users including administrators in Cisco Unity Express.

DETAILS

Vulnerable Systems:
 * Cisco Unity Express version 2.3 and prior

Immune Systems:
 * Cisco Unity Express version 2.31

Cisco Unity Express (CUE) is an optional hardware module designed for use 
with Cisco modular routers to provide voice mail and automated attendant 
services. The HTTP management interface of a CUE module allows 
authenticated users to change their password. This vulnerability allows 
authenticated users to change the password for any user with an expired 
password. If an administrator's account has expired, the administrator's 
password can be changed allowing an unprivileged user to gain complete 
administrative control of a CUE module.

There are three ways for a user to have an expired password.

 * Newly created users with blank passwords.
CUE treats blank passwords as expired. This feature was introduced in CUE 
software version 1.1(1).
 * Newly created users with a randomly selected password.
Administrators can elect to have a random password assigned when creating 
new users. CUE treats the random passwords as expired.
This feature was introduced in CUE software version 1.1(1).
 * If the system-wide password expiry feature is enabled, user passwords 
can be configured to expire after a specified number of days. Users with 
expired passwords are required to change their password. This feature was 
introduced in CUE software version 2.1(1).


Successful exploitation of the vulnerability allow an unprivileged user to 
gain complete administrative control of a CUE module. This may result in 
the disclosure of sensitive information contained in voice mail stored on 
a CUE module and possible negative publicity if automated attendant 
messages are maliciously changed.

Workaround:
It is possible to mitigate this vulnerability by restricting access to the 
HTTP management interface to trusted management hosts with an access 
control list (ACL) applied on the router hosting the CUE module. This will 
prevent users from accessing some CUE functionality such as setting their 
display name. Users can continue to access their voice mail and perform a 
limited number of configuration changes such as updating their personal 
identification number (PIN).
Management functions can be performed using the CUE command line 
interface.


ADDITIONAL INFORMATION

The information has been provided by  <mailto:psirt@cisco.com.> Cisco  
Security Team.
The original article can be found at:  
<http://www.cisco.com/warp/public/707/cisco-sa-20060501-cue.shtml>; 
http://www.cisco.com/warp/public/707/cisco-sa-20060501-cue.shtml




This bulletin is sent to members of the SecuriTeam mailing list. To unsubscribe from the list, send mail with an empty subject line and body to: [email protected] In order to subscribe to the mailing list, simply forward this email to: [email protected]

DISCLAIMER: The information in this bulletin is provided "AS IS" without warranty of any kind. In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

<< Previous INDEX Search src / Print Next >>



Партнёры:
PostgresPro
Inferno Solutions
Hosting by Hoster.ru
Хостинг:

Закладки на сайте
Проследить за страницей
Created 1996-2024 by Maxim Chirkov
Добавить, Поддержать, Вебмастеру