CVE-2007-4634: SQL Injection

Published Aug 31, 2007

Updated

Multiple SQL injection vulnerabilities in Cisco CallManager and Unified Communications Manager (CUCM) before 3.3(5)sr2b, 4.1 before 4.1(3)sr5, 4.2 before 4.2(3)sr2, and 4.3 before 4.3(1)sr1 allow remote attackers to execute arbitrary SQL commands via the lang variable to the (1) user or (2) admin logon page, aka CSCsi64265.

Affected Software

31 affected components

Cisco Call Manager=4.2\(2\)

Cisco Unified Communications Manager=3.3\(5\)

Cisco Call Manager=3.3\(5\)sr2

Cisco Call Manager=4.3\(1\)

Cisco Unified Communications Manager=4.1\(3\)sr1

Cisco Call Manager=4.1\(3\)sr1

Cisco Call Manager=4.1

Cisco Call Manager=3.3\(5\)sr2a

Cisco Unified Communications Manager=4.2.3sr1

Cisco Unified Communications Manager=4.1\(3\)sr2

Cisco Call Manager=4.1\(3\)sr2

Cisco Unified Communications Manager=4.1\(3\)

Cisco Unified Communications Manager=4.2

Cisco Unified Communications Manager=4.3

Cisco Unified Communications Manager=4.2.3

Cisco Unified Communications Manager=4.1\(3\)sr4

Cisco Call Manager=4.2

Cisco Unified Communications Manager=4.2.1

Cisco Call Manager=4.2\(1\)

Cisco Call Manager=4.3

Cisco Call Manager=4.1\(3\)sr3

Cisco Unified Communications Manager=3.3\(5\)sr2a

Cisco Call Manager=4.2\(3\)sr1

Cisco Unified Communications Manager=4.2.2

Cisco Unified Communications Manager=4.3\(1\)

Cisco Unified Communications Manager=4.1\(3\)sr3

Cisco Call Manager=4.2\(3\)

Cisco Unified Communications Manager=3.3\(5\)sr1

Cisco Call Manager=4.2\(3\)sr2

Cisco Call Manager=4.1\(3\)sr4

Cisco Call Manager=3.3\(5\)sr1

Event History

Aug 31, 2007

CVE Published

11:17 PM

Sep 1, 2007

CVE Published

via MITRE·03:00 AM

Data Sourced

via MITRE·03:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-4634?

CVE-2007-4634 has been classified as a critical vulnerability due to its potential for remote exploitation.

How do I fix CVE-2007-4634?

To fix CVE-2007-4634, upgrade Cisco CallManager and Unified Communications Manager to the recommended version as per the vendor's advisory.

Which Cisco products are affected by CVE-2007-4634?

CVE-2007-4634 affects several versions of Cisco CallManager and Unified Communications Manager, specifically versions prior to 3.3(5)sr2b, 4.1(3)sr5, 4.2(3)sr2, and 4.3(1)sr1.

What type of attack can be executed through CVE-2007-4634?

CVE-2007-4634 allows remote attackers to execute arbitrary SQL commands.

When was CVE-2007-4634 published?

CVE-2007-4634 was published on August 14, 2007.