Cisco Security Advisory
Click Icon to Copy Verbose Score
AV:N/AC:L/Au:S/C:C/I:C/A:C/E:F/RL:OF/RC:C
-
A vulnerability exists in the Cisco Unified Customer Voice Portal (CVP) where an authenticated user can create, modify, or delete a superuser account. Cisco has released software updates that address this vulnerability.
This advisory is posted at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20080521-cvp.
-
Vulnerable Products
CVP software versions prior to 4.0(2)_ES14 for the 4.0.x release, 4.1(1)_ES11 for the 4.1.x release are vulnerable.
Note: CVP systems running software release 3.x and 7.0(1) are not vulnerable.
Products Confirmed Not Vulnerable
CVP systems running software release 3.x are not vulnerable. CVP systems running version 7.0(1) or later are not vulnerable. No other Cisco products are currently known to be affected by this vulnerability.
-
Cisco Unified Customer Voice Portal (CVP), which is part of Cisco Customer Interaction Network solution, provides customer voice and video self-service integration. Using CVP, organizations can provide intelligent, personalized self-service over the phone, allowing customers to efficiently retrieve the information they need from the contact center.
There are three different user roles within CVP: superuser, administrator, and read-only access. A vulnerability exists in CVP where a user with an administrator role can create, modify, or delete a superuser account, which has greater system privileges.
This vulnerability is documented in the Cisco Bug ID CSCsj93874 ( registered customers only) and has been assigned Common Vulnerability and Exposures (CVE) ID CVE-2008-2053.
-
There are no workarounds for this vulnerability.
-
This vulnerability is fixed in the Cisco Unified Customer Voice Portal (CVP) software version 4.0(2)_ES14 for the 4.0.x release, 4.1(1)_ES11 for the 41.x release, and 7.0(1) for the 7.x release.
CVP software version 4.0(2)_ES14 can be downloaded from: http://www.cisco.com/pcgi-bin/tablebuild.pl/36833091037661f49ad8152368c22bbf
CVP software version 4.1(1)_ES11 can be downloaded from: http://www.cisco.com/pcgi-bin/tablebuild.pl/946b57654c80187da8c3cfc0aa02866e
When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution.
In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider for assistance.
-
The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory.
This vulnerability was found during internal product testing.
-
To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.
-
Show Less
Revision 1.0
2008-May-21
Initial public release.
-
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
A stand-alone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy, and may lack important information or contain factual errors. The information in this document is intended for end-users of Cisco products.