CVE-2010-3039

/usr/local/cm/bin/pktCap_protectData in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6, 7, and 8 allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in a request to the administrative interface, aka Bug IDs CSCti52041 and CSCti74930.

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:L/AC:L/Au:S/C:C/I:C/A:C

Exploitability : 3.1 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://seclists.org/fulldisclosure/2010/Nov/40	Exploit
http://secunia.com/advisories/42129	Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=21656	Vendor Advisory
http://www.nsense.fi/advisories/nsense_2010_003.txt	Exploit
http://www.securityfocus.com/archive/1/514668/100/0/threaded
http://www.securityfocus.com/bid/44672	Exploit
http://www.securitytracker.com/id?1024694
http://www.vupen.com/english/advisories/2010/2915	Vendor Advisory
http://seclists.org/fulldisclosure/2010/Nov/40	Exploit
http://secunia.com/advisories/42129	Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=21656	Vendor Advisory
http://www.nsense.fi/advisories/nsense_2010_003.txt	Exploit
http://www.securityfocus.com/archive/1/514668/100/0/threaded
http://www.securityfocus.com/bid/44672	Exploit
http://www.securitytracker.com/id?1024694
http://www.vupen.com/english/advisories/2010/2915	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:cisco:unified_communications_manager:6.0:::::::*
	cpe:2.3:a:cisco:unified_communications_manager:6.1\(1\):::::::*
	cpe:2.3:a:cisco:unified_communications_manager:6.1\(1a\):::::::*
	cpe:2.3:a:cisco:unified_communications_manager:6.1\(1b\):::::::*
	cpe:2.3:a:cisco:unified_communications_manager:6.1\(2\):::::::*
	cpe:2.3:a:cisco:unified_communications_manager:6.1\(2\)su1:::::::*
	cpe:2.3:a:cisco:unified_communications_manager:6.1\(2\)su1a:::::::*
	cpe:2.3:a:cisco:unified_communications_manager:6.1\(3\):::::::*
	cpe:2.3:a:cisco:unified_communications_manager:6.1\(3a\):::::::*
	cpe:2.3:a:cisco:unified_communications_manager:6.1\(3b\):::::::*
	cpe:2.3:a:cisco:unified_communications_manager:6.1\(3b\)su1:::::::*
	cpe:2.3:a:cisco:unified_communications_manager:6.1\(4\):::::::*
	cpe:2.3:a:cisco:unified_communications_manager:6.1\(4\)su1:::::::*
	cpe:2.3:a:cisco:unified_communications_manager:6.1\(4a\):::::::*
	cpe:2.3:a:cisco:unified_communications_manager:6.1\(4a\)su2:::::::*
	cpe:2.3:a:cisco:unified_communications_manager:6.1\(5\):::::::*

Configuration 2 (hide)

OR	cpe:2.3:a:cisco:unified_communications_manager:7.0:::::::*
	cpe:2.3:a:cisco:unified_communications_manager:7.0\(1\)su1:::::::*
	cpe:2.3:a:cisco:unified_communications_manager:7.0\(1\)su1a:::::::*
	cpe:2.3:a:cisco:unified_communications_manager:7.0\(2\):::::::*
	cpe:2.3:a:cisco:unified_communications_manager:7.0\(2a\):::::::*
	cpe:2.3:a:cisco:unified_communications_manager:7.0\(2a\)su1:::::::*
	cpe:2.3:a:cisco:unified_communications_manager:7.0\(2a\)su2:::::::*
	cpe:2.3:a:cisco:unified_communications_manager:7.1\(2a\):::::::*
	cpe:2.3:a:cisco:unified_communications_manager:7.1\(2a\)su1:::::::*
	cpe:2.3:a:cisco:unified_communications_manager:7.1\(2b\):::::::*
	cpe:2.3:a:cisco:unified_communications_manager:7.1\(2b\)su1:::::::*
	cpe:2.3:a:cisco:unified_communications_manager:7.1\(3\):::::::*
	cpe:2.3:a:cisco:unified_communications_manager:7.1\(3a\):::::::*
	cpe:2.3:a:cisco:unified_communications_manager:7.1\(3a\)su1:::::::*
	cpe:2.3:a:cisco:unified_communications_manager:7.1\(3a\)su1a:::::::*
	cpe:2.3:a:cisco:unified_communications_manager:7.1\(3b\):::::::*
	cpe:2.3:a:cisco:unified_communications_manager:7.1\(3b\)su1:::::::*
	cpe:2.3:a:cisco:unified_communications_manager:7.1\(3b\)su2:::::::*
	cpe:2.3:a:cisco:unified_communications_manager:7.1\(5\):::::::*
	cpe:2.3:a:cisco:unified_communications_manager:7.1\(5\)su1:::::::*
	cpe:2.3:a:cisco:unified_communications_manager:7.1\(5\)su1a:::::::*
	cpe:2.3:a:cisco:unified_communications_manager:7.1\(5a\):::::::*
	cpe:2.3:a:cisco:unified_communications_manager:7.1\(5b\):::::::*

Configuration 3 (hide)

OR	cpe:2.3:a:cisco:unified_communications_manager:8.0:::::::*
	cpe:2.3:a:cisco:unified_communications_manager:8.0\(2c\):::::::*
	cpe:2.3:a:cisco:unified_communications_manager:8.0\(2c\)su1:::::::*
	cpe:2.3:a:cisco:unified_communications_manager:8.0\(3\):::::::*

History

21 Nov 2024, 01:17

Type	Values Removed	Values Added
References	~~() http://seclists.org/fulldisclosure/2010/Nov/40 - Exploit~~	() http://seclists.org/fulldisclosure/2010/Nov/40 - Exploit
References	~~() http://secunia.com/advisories/42129 - Vendor Advisory~~	() http://secunia.com/advisories/42129 - Vendor Advisory
References	~~() http://tools.cisco.com/security/center/viewAlert.x?alertId=21656 - Vendor Advisory~~	() http://tools.cisco.com/security/center/viewAlert.x?alertId=21656 - Vendor Advisory
References	~~() http://www.nsense.fi/advisories/nsense_2010_003.txt - Exploit~~	() http://www.nsense.fi/advisories/nsense_2010_003.txt - Exploit
References	~~() http://www.securityfocus.com/archive/1/514668/100/0/threaded -~~	() http://www.securityfocus.com/archive/1/514668/100/0/threaded -
References	~~() http://www.securityfocus.com/bid/44672 - Exploit~~	() http://www.securityfocus.com/bid/44672 - Exploit
References	~~() http://www.securitytracker.com/id?1024694 -~~	() http://www.securitytracker.com/id?1024694 -
References	~~() http://www.vupen.com/english/advisories/2010/2915 - Vendor Advisory~~	() http://www.vupen.com/english/advisories/2010/2915 - Vendor Advisory

Information

Published : 2010-11-09 21:00

Updated : 2024-11-21 01:17

NVD link : CVE-2010-3039

Mitre link : CVE-2010-3039

CVE.ORG link : CVE-2010-3039

JSON object : View

Products Affected

cisco

unified_communications_manager

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

6.8 /10