-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Reference: CERT-EU Security Advisory 2012-0027

Title: Multiple Vulnerabilities in Cisco Unity Connection

Version history:
01.03.2012 Initial publication

Summary
=======
CVSS Base Scores

CVE-2012-0366: Privilege Escalation Vulnerability
CVSS v2 Base Score: 9.0 (CRITICAL) (AV:N/AC:L/Au:S/C:C/I:C/A:C) [3])

CVE-2012-0367: Denial of Service Vulnerability
CVSS v2 Base Score: 7.8 (HIGH) (AV:N/AC:L/Au:N/C:N/I:N/A:C) [3])

Affected Versions
=================
For CVE-2012-0366: Privilege Escalation Vulnerability:

Cisco Unity Connection 7.1 and before

For CVE-2012-0367: Denial of Service Vulnerability

Cisco Unity Connection 8.6 and before

Original Details
================
CVE-2012-0366: Privilege Escalation Vulnerability

Cisco Unity Connection contains a vulnerability that may allow an authenticated, remote attacker with privilege of the Help Desk
Administrator role to elevate privileges and obtain full access to the affected system.

The vulnerability is due to improper privilege assignment and validation of the "Help Desk Administrator" role. An attacker could exploit this vulnerability by logging in to the system as the Help Desk Administrator user and changing the password for the administrative user.

CVE-2012-0367: Denial of Service Vulnerability

Cisco Unity Connection contains a vulnerability that may allow an unauthenticated, remote attacker to cause system services to terminate unexpectedly, which may result in a denial of service. The vulnerability is due to improper handling of TCP segments. An attacker could exploit this vulnerability by sending a sequence of TCP segments to the affected system.

What can you do?
================
Deploy the updated versions of the software [2].

Workarounds:

There are no workarounds that mitigate these vulnerabilities.

What to tell your users?
========================
N/A

More information
================
[1] CISCO http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120229-cuc
[2] CISCO Software Download http://www.cisco.com/cisco/software/find.html?q=nx-os
[3] Information about CVSS: http://www.first.org/cvss/cvss-guide.html

Best regards,
CERT-EU
CERT-EU Pre-configuration Team (http://cert.europa.eu)
Phone: +32.2.2990005 / e-mail: cert-eu@ec.europa.eu
PGP KeyID 0x46AC4383
FP: 9011 6BE9 D642 DD93 8348 DAFA 27A4 06CA 46AC 4383

(DISCLAIMER: CERT-EU, the CERT for the EU institutions, is currently in its setup phase, until May 2012. Services are provided in a pilot fashion, and are not yet fully functional. Announcements, alerts and warnings are sent out in best effort manner, and to contact information currently known to us. We apologise if you are not the correct recipient, or if you had already been warned about this issue from another source . Format, content and way of alerting are subject to change in the future. Contact information or even the team name may change as well.)
-----BEGIN PGP SIGNATURE-----
Version: BCPG v1.39

iQJXBAEBAgBBBQJPTzy3OhxDRVJUIGZvciB0aGUgRXVyb3BlYW4gSW5zdGl0dXRp
b25zIDxjZXJ0LWV1QGVjLmV1cm9wYS5ldT4ACgkQJ6QGykasQ4PqMA//TWxfM5OR
/5MvsSqndLgdJry7jg94oqgeAs/E1RpdIjRShIgaFiB1/XaLN4x/9RL3wWvm5EDr
zlQLGejaBks5OlSy2xdfiT37AJ4nNHunYC8vNJj65oiQnK1rKH1qkDj2Vyf1mC5g
Cda3VfL5Kkcjm0wP3CpsAAWZUUbEfSsUovC7RUEg/UJZiCdiM+wl9mE0DSZXUU7Y
4RZVXKusEC4Lx1iu2ZQ3xTduLuOIH0BJj7Aku/AJEiNOa9gOE+chWJqQYtCoXeD1
VZhlVNn3YZQf/mKsTakVTGdbKQzetVWVAXrRNrMN2+9+6BharzB23lXTpMYhQfAm
VN/I1p1HPRF7MaYLCa8F1siGZ61kJS7CjkzLPn3bf0/C3iGKL4qB+ve8aLVkLuxu
+nIfrmT3+tSDySrSvlnkZEzosVxpbpHyzC2mAJSHS7AtOvSM5XBc93npMBfiQAvV
Ts8wTxKNKEElz+F51cUkznXVhwP9lVHYAOu5LVK9qXUeswyWu+6G1ydVlx/VXk5A
jb+U+0uXpBybzf3niJMxurkZZpBfx5nRGHVDXYzWoX238m1r6ISnXgWcr2jx826o
4ddXi+MKSKeP665zMiHytsnNhcryMV1L+a3+NcXRXxQ0yi0eVGuOT+bK4s3ycukD
M529qKo+VWnrj46LYSS+ygFRFNmPcx9RqL0=
=41N8
-----END PGP SIGNATURE-----