OSVDB ID: 22621

Title: Cisco CallManager CCMAdmin Crafted URL Privilege Escalation

Info

Disclosure
Jan 18, 2006

Discovery
Unknown

Dates

Exploit
Unknown

Solution
Unknown

Description

 Cisco CallManager contains a flaw that may allow a malicious user to gain access to unauthorized privileges. The issue is triggered when a read-only administrative user submits a specifically crafted URL to the CCMAdmin control panel, allowing them to gain full administrative access. This flaw may lead to a loss of integrity.

Classification

 Location: Remote / Network Access
Attack Type: Authentication Management
Impact: Loss of Integrity
Exploit: Exploit Unknown
OSVDB: Web Related, Voice over IP

Solution

 The vendor has released a number of updates, which have been reported to fix this vulnerability. Users of version 3.2 are requested to migrate to version 3.3. An upgrade is required as there are no known workarounds.

Products

Cisco Systems, Inc.

Call Manager

 4.1(3)SR1
4.0(2a)SR2b
3.3(5)
3.2

References

Credit
  • CNLabs - CNLabs


Direct URL: http://osvdb.org/22621