----------------------------------------------------------------------

Do you have VARM strategy implemented?

(Vulnerability Assessment Remediation Management)  

If not, then implement it through the most reliable vulnerability
intelligence source on the market. 

Implement it through Secunia. 

For more information visit:
http://secunia.com/advisories/business_solutions/

Alternatively request a call from a Secunia representative today to
discuss how we can help you with our capabilities contact us at:
sales@secunia.com

----------------------------------------------------------------------

TITLE:
Cisco Unified Contact Center Express Two Vulnerabilities

SECUNIA ADVISORY ID:
SA35861

VERIFY ADVISORY:
http://secunia.com/advisories/35861/

DESCRIPTION:
Two vulnerabilities have been reported in Cisco Unified Contact
Center Express, which can be exploited by malicious users to conduct
script insertion attacks, manipulate certain data, disclose
potentially sensitive information, and potentially compromise a
vulnerable system.

1) Certain unspecified input is not properly sanitised before being
used within the Customer Response Solutions (CRS) Administration
interface. This can be exploited to view, modify, or delete arbitrary
files on an affected system via directory traversal attacks.

2) Certain input to the Cisco Unified CCX database is not properly
sanitised before being used. This can be exploited to insert
arbitrary HTML and script code, which will be executed in a user's
browser session in context of an affected site when the malicious
data is viewed.

The vulnerabilities affect all versions of Cisco Unified CCX server
running the following software:
* Cisco Customer Response Solution (CRS) versions 3.x, 4.x, 5.x, 6.x,
and 7.x
* Cisco Unified IP Interactive Voice Response (Cisco Unified IP IVR)
versions 3.x, 4.x, 5.x, 6.x, and 7.x
* Cisco Unified CCX 4.x, 5.x, 6.x, and 7.x
* Cisco Unified IP Contact Center Express versions 3.x, 5.x, 6.x, and
7.x
* Cisco Customer Response Applications versions 3.x
* Cisco IP Queue Manager (IP QM) versions 3.x

SOLUTION:
Update Customer Response Solutions (CRS) or apply hotfixes.

CRS 7x:
Update to CRS version 7.0(1) SR2.

CRS 5.x and 6.x:
Apply hotfix crs5.0.2sr2es09 or crs6.0.1sr1es05.

PROVIDED AND/OR DISCOVERED BY:
The vendor credits National Australia Bank's Security Assurance team.

ORIGINAL ADVISORY:
http://www.cisco.com/warp/public/707/cisco-sa-20090715-uccx.shtml

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------