Vulnerability CVE-2011-1637
Published: 2011-06-02   Modified: 2012-02-13

Description:
Cisco Unified IP Phones 7900 devices (aka TNP phones) with software before 9.2.1 do not properly verify signatures for software images, which allows local users to gain privileges via a crafted image, aka Bug ID CSCtn65962.

Type:

CWE-264

 (Permissions, Privileges, and Access Controls)

CVSS2 => (AV:L/AC:M/Au:S/C:P/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
1.5/10
2.9/10
2.7/10
Exploit range
Attack complexity
Authentication
Local
Medium
Single time
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None
Affected software
Cisco -> Unified ip phone 7906 
Cisco -> Unified ip phone 7911g 
Cisco -> Unified ip phone 7931g 
Cisco -> Unified ip phone 7941g 
Cisco -> Unified ip phone 7941g-ge 
Cisco -> Unified ip phone 7942g 
Cisco -> Unified ip phone 7945g 
Cisco -> Unified ip phone 7961g 
Cisco -> Unified ip phone 7961g-ge 
Cisco -> Unified ip phone 7962g 
Cisco -> Unified ip phone 7965g 
Cisco -> Unified ip phone 7970g 
Cisco -> Unified ip phone 7971g-ge 
Cisco -> Unified ip phone 7975g 
Cisco -> Skinny client control protocol software 

 References:
http://xforce.iss.net/xforce/xfdb/67743
http://www.securitytracker.com/id?1025588
http://www.securityfocus.com/bid/48075
http://www.cisco.com/en/US/products/products_security_advisory09186a0080b80111.shtml
http://secunia.com/advisories/44814/
http://osvdb.org/72719
Copyright 2024, cxsecurity.com

 

Back to Top