CVE-2009-0632

Cisco Unified Communications Manager Cleartext Credential Exposure via IP Phone PAB Synchronizer

Title source: llm
STIX 2.1

Description

The IP Phone Personal Address Book (PAB) Synchronizer feature in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 4.1, 4.2 before 4.2(3)SR4b, 4.3 before 4.3(2)SR1b, 5.x before 5.1(3e), 6.x before 6.1(3), and 7.0 before 7.0(2) sends privileged directory-service account credentials to the client in cleartext, which allows remote attackers to modify the CUCM configuration and perform other privileged actions by intercepting these credentials, and then using them in requests unrelated to the intended synchronization task, as demonstrated by (1) DC Directory account credentials in CUCM 4.x and (2) TabSyncSysUser account credentials in CUCM 5.x through 7.x.

References (8)

Core 8
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/34082
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/52589
Patch, Vendor Advisory vendor-advisory x_refsource_cisco
http://www.cisco.com/en/US/products/products_security_advisory09186a0080a8643c.shtml
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1021839
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/49196
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/34238
Patch, Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2009/0675

Scores

EPSS 0.0302
EPSS Percentile 86.1%

Details

CWE
CWE-255
Status published
Products (30)
cisco/unified_communications_manager 4.1
cisco/unified_communications_manager 4.2
cisco/unified_communications_manager 4.2\(3\)sr1
cisco/unified_communications_manager 4.2\(3\)sr2b
cisco/unified_communications_manager 4.2\(3\)sr3
cisco/unified_communications_manager 4.2\(3\)sr4
cisco/unified_communications_manager 4.3
cisco/unified_communications_manager 4.3\(1\)sr.1
cisco/unified_communications_manager 4.3\(2\)
cisco/unified_communications_manager 4.3\(2\)sr1
... and 20 more
Published Mar 12, 2009
Tracked Since Feb 18, 2026