From: SecuriTeam <support@securiteam.com.>
To: [email protected]
Date: 2 May 2006 11:06:32 +0200
Subject: [NEWS] Cisco Unity Express Privilege Escalation
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-Id: <20060502085309.44CE4581B@mail.tyumen.ru.>
X-Virus-Scanned: antivirus-gw at tyumen.ru
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Cisco Unity Express Privilege Escalation
------------------------------------------------------------------------
SUMMARY
" <http://www.cisco.com/en/US/products/sw/voicesw/ps5520/index.html>; Cisco
Unity Express enables small and medium-sized businesses (SMBs) and
enterprise branch offices to cost-effectively integrate voice mail and
auto attendant services inside Cisco routers for a lower total cost of
ownership and increased employee productivity."
Improper handling of user authentication validation allows users to modify
passwords for other users including administrators in Cisco Unity Express.
DETAILS
Vulnerable Systems:
* Cisco Unity Express version 2.3 and prior
Immune Systems:
* Cisco Unity Express version 2.31
Cisco Unity Express (CUE) is an optional hardware module designed for use
with Cisco modular routers to provide voice mail and automated attendant
services. The HTTP management interface of a CUE module allows
authenticated users to change their password. This vulnerability allows
authenticated users to change the password for any user with an expired
password. If an administrator's account has expired, the administrator's
password can be changed allowing an unprivileged user to gain complete
administrative control of a CUE module.
There are three ways for a user to have an expired password.
* Newly created users with blank passwords.
CUE treats blank passwords as expired. This feature was introduced in CUE
software version 1.1(1).
* Newly created users with a randomly selected password.
Administrators can elect to have a random password assigned when creating
new users. CUE treats the random passwords as expired.
This feature was introduced in CUE software version 1.1(1).
* If the system-wide password expiry feature is enabled, user passwords
can be configured to expire after a specified number of days. Users with
expired passwords are required to change their password. This feature was
introduced in CUE software version 2.1(1).
Successful exploitation of the vulnerability allow an unprivileged user to
gain complete administrative control of a CUE module. This may result in
the disclosure of sensitive information contained in voice mail stored on
a CUE module and possible negative publicity if automated attendant
messages are maliciously changed.
Workaround:
It is possible to mitigate this vulnerability by restricting access to the
HTTP management interface to trusted management hosts with an access
control list (ACL) applied on the router hosting the CUE module. This will
prevent users from accessing some CUE functionality such as setting their
display name. Users can continue to access their voice mail and perform a
limited number of configuration changes such as updating their personal
identification number (PIN).
Management functions can be performed using the CUE command line
interface.
ADDITIONAL INFORMATION
The information has been provided by <mailto:psirt@cisco.com.> Cisco
Security Team.
The original article can be found at:
<http://www.cisco.com/warp/public/707/cisco-sa-20060501-cue.shtml>;
http://www.cisco.com/warp/public/707/cisco-sa-20060501-cue.shtml
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected]
In order to subscribe to the mailing list, simply forward this email to: [email protected]
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
