----------------------------------------------------------------------

Do you need accurate and reliable IDS / IPS / AV detection rules?

Get in-depth vulnerability details:
http://secunia.com/binary_analysis/sample_analysis/

----------------------------------------------------------------------

TITLE:
Cisco Unity Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA32187

VERIFY ADVISORY:
http://secunia.com/advisories/32187/

CRITICAL:
Less critical

IMPACT:
Security Bypass, Exposure of sensitive information, DoS

WHERE:
>From local network

SOFTWARE:
Cisco Unity 4.x
http://secunia.com/advisories/product/4386/
Cisco Unity 5.x
http://secunia.com/advisories/product/20082/
Cisco Unity 7.x
http://secunia.com/advisories/product/20083/

DESCRIPTION:
Some vulnerabilities and a security issue have been reported in Cisco
Unity, which can be exploited by malicious, local users to disclose
potentially sensitive information, and by malicious people to bypass
certain security restrictions and cause a DoS (Denial of Service).

1) An error exists within the authentication process in the Cisco
Unity server, which can be exploited to bypass the authentication
mechanism and view or modify certain system configuration
parameters.

2) An error in the session handling in the Cisco Unity server can be
exploited to cause a DoS by exhausting all available sessions.

Successful exploitation of these vulnerabilities requires that the
Cisco Unity server is configured for anonymous authentication (not
the default configuration).

3) A security issue is caused due to insecure permissions on
"\CommServer\Reports", which can be exploited by domain users to
disclose potentially sensitive information.

SOLUTION:
Update to version 4.0ES161, 5.0ES53, or 7.0ES8.
http://tools.cisco.com/support/downloads/go/Redirect.x?mdfid=274246502

PROVIDED AND/OR DISCOVERED BY:
VoIPshield Systems

ORIGINAL ADVISORY:
Cisco:
http://www.cisco.com/warp/public/707/cisco-sa-20081008-unity.shtml
http://www.cisco.com/warp/public/707/cisco-sr-20081008-unity.shtml

VoIPshield:
http://www.voipshield.com/research-details.php?id=126&s=1&threats_details=&threats_category=0&threats_vendor=0&limit=20&sort=discovered&sortby=DESC
http://www.voipshield.com/research-details.php?id=128&s=1&threats_details=&threats_category=0&threats_vendor=0&limit=20&sort=discovered&sortby=DESC
http://www.voipshield.com/research-details.php?id=130&s=1&threats_details=&threats_category=0&threats_vendor=0&limit=20&sort=discovered&sortby=DESC

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------