NVD

Id
47961  
Name
CVE-2009-0632  
Description
The IP Phone Personal Address Book (PAB) Synchronizer feature in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 4.1, 4.2 before 4.2(3)SR4b, 4.3 before 4.3(2)SR1b, 5.x before 5.1(3e), 6.x before 6.1(3), and 7.0 before 7.0(2) sends privileged directory-service account credentials to the client in cleartext, which allows remote attackers to modify the CUCM configuration and perform other privileged actions by intercepting these credentials, and then using them in requests unrelated to the intended synchronization task, as demonstrated by (1) DC Directory account credentials in CUCM 4.x and (2) TabSyncSysUser account credentials in CUCM 5.x through 7.x.  
Reject
 
CVSS Version
2  
CVSS Score
9  
Severity
High  
CVSS Base Score
9  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
8  
CVSS Vector
(AV:N/AC:L/Au:S/C:C/I:C/A:C)  
Pub Date
2017-01-07  
Published
2009-03-12  
Modified Date
2009-03-21  
Seq
2009-0632  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
240445 47961 CVE-2009-0632 20090311 Identifying and Mitigating Exploitation of the Cisco Unified Communications Manager IP Phone Personal Address Book Synchronizer Privilege Escalation Vulnerability  View
240446 47961 CVE-2009-0632 20090311 Cisco Unified Communications Manager IP Phone Personal Address Book Synchronizer Privilege Escalation Vulnerability  View
240447 47961 CVE-2009-0632 34082  View
240448 47961 CVE-2009-0632 1021839  View
240449 47961 CVE-2009-0632 ADV-2009-0675  View
240450 47961 CVE-2009-0632 cucm-pab-privilege-escalation(49196)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
40390 JVNDB-2009-001396 Cisco Unified Communications Manager の IP Phone Personal Address Book (PAB) Synchronizer 機能における権限昇格の脆弱性 Cisco Unified Communications Manager (別名 CUCM、 旧 CallManager) の IP Phone Personal Address Book (PAB) Synchronizer 機能には、特権を持つディレクトリサービスアカウントの認証情報をクライアントに平文で送信することに起因した、権限昇格の脆弱性が存在します。 CVE-2009-0632 38063 CVE-2009-0632 47961 9 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001396.html 2009-03-12 2009-06-30 View