CVE-2007-1820

Nortel Networks CallPilot and Meridian Mail voicemail systems, when a mailbox has auto logon enabled, allow remote attackers to retrieve or remove messages, or reconfigure the mailbox, by spoofing Calling Number Identification (CNID, aka Caller ID).

CVSS v2.0 9.3 HIGH

9.3^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://osvdb.org/34983
http://www.kb.cert.org/vuls/id/726548	US Government Resource
http://www.kb.cert.org/vuls/id/AAMN-5N2QFX

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:nortel:callpilot::::::::
	cpe:2.3:a:nortel:meridian_mail::::::::

History

No history.

Information

Published : 2007-04-02 23:19

Updated : 2024-02-28 11:01

NVD link : CVE-2007-1820

Mitre link : CVE-2007-1820

CVE.ORG link : CVE-2007-1820

JSON object : View

Products Affected

nortel

callpilot
meridian_mail

CWE

NVD-CWE-Other

{"id": "CVE-2007-1820", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": true, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2007-04-02T23:19:00.000", "references": [{"url": "http://osvdb.org/34983", "source": "cve@mitre.org"}, {"url": "http://www.kb.cert.org/vuls/id/726548", "tags": ["US Government Resource"], "source": "cve@mitre.org"}, {"url": "http://www.kb.cert.org/vuls/id/AAMN-5N2QFX", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Nortel Networks CallPilot and Meridian Mail voicemail systems, when a mailbox has auto logon enabled, allow remote attackers to retrieve or remove messages, or reconfigure the mailbox, by spoofing Calling Number Identification (CNID, aka Caller ID)."}, {"lang": "es", "value": "Los sistemas de email por voz Nortel Networks CallPilot y Meridian Mail, cuando la bandeja de entrada tiene activado la auto entrada, permite a atacantes remotos recuperar o borrar mensajes, o reconfigurar la bandeja de entrada, a trav\u00e9s de la suplantaci\u00f3n Calling Number Identification (CNID, tambi\u00e9n conocida como Caller ID)."}], "lastModified": "2008-11-13T06:36:29.117", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nortel:callpilot:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7E04798A-2BBC-4955-AFA5-30B73CF55CC0"}, {"criteria": "cpe:2.3:a:nortel:meridian_mail:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C753D176-888D-4CBA-9663-ABA81D531758"}], "operator": "OR"}]}], "evaluatorImpact": "Access complexity set to Medium because Nortel Networks voicemail systems do not hard code or default to this behavior.", "sourceIdentifier": "cve@mitre.org"}