CVE-2010-3039: OS Command Injection

Published Nov 9, 2010

Updated

/usr/local/cm/bin/pktCapprotectData in Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6, 7, and 8 allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in a request to the administrative interface, aka Bug IDs CSCti52041 and CSCti74930.

Affected Software

43 affected components

Cisco Unified Communications Manager=6.1\(3a\)

Cisco Unified Communications Manager=6.1\(2\)

Cisco Unified Communications Manager=6.1\(3b\)su1

Cisco Unified Communications Manager=6.1\(2\)su1a

Cisco Unified Communications Manager=6.1\(4\)su1

Cisco Unified Communications Manager=6.1\(4\)

Cisco Unified Communications Manager=6.1\(4a\)

Cisco Unified Communications Manager=6.1\(3\)

Cisco Unified Communications Manager=6.1\(4a\)su2

Cisco Unified Communications Manager=6.1\(1\)

Cisco Unified Communications Manager=6.1\(1b\)

Cisco Unified Communications Manager=6.1\(3b\)

Cisco Unified Communications Manager=6.1\(5\)

Cisco Unified Communications Manager=6.1\(2\)su1

Cisco Unified Communications Manager=6.0

Cisco Unified Communications Manager=6.1\(1a\)

Cisco Unified Communications Manager=7.1\(2b\)su1

Cisco Unified Communications Manager=7.1\(2b\)

Cisco Unified Communications Manager=7.1\(3b\)

Cisco Unified Communications Manager=7.1\(2a\)su1

Cisco Unified Communications Manager=7.1\(3b\)su1

Cisco Unified Communications Manager=7.1\(3a\)su1a

Cisco Unified Communications Manager=7.1\(3\)

Cisco Unified Communications Manager=7.1\(2a\)

Cisco Unified Communications Manager=7.1\(5b\)

Cisco Unified Communications Manager=7.0\(2a\)

Cisco Unified Communications Manager=7.0\(1\)su1

Cisco Unified Communications Manager=7.0\(1\)su1a

Cisco Unified Communications Manager=7.1\(5\)

Cisco Unified Communications Manager=7.1\(5a\)

Cisco Unified Communications Manager=7.0\(2a\)su2

Cisco Unified Communications Manager=7.1\(5\)su1a

Cisco Unified Communications Manager=7.1\(5\)su1

Cisco Unified Communications Manager=7.0

Cisco Unified Communications Manager=7.1\(3a\)

Cisco Unified Communications Manager=7.0\(2a\)su1

Cisco Unified Communications Manager=7.1\(3a\)su1

Cisco Unified Communications Manager=7.0\(2\)

Cisco Unified Communications Manager=7.1\(3b\)su2

Cisco Unified Communications Manager=8.0\(2c\)

Cisco Unified Communications Manager=8.0

Cisco Unified Communications Manager=8.0\(3\)

Cisco Unified Communications Manager=8.0\(2c\)su1

Event History

Nov 9, 2010

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2010-3039?

CVE-2010-3039 is rated as high severity due to the ability for remote authenticated administrators to execute arbitrary commands.

How do I fix CVE-2010-3039?

To fix CVE-2010-3039, update your Cisco Unified Communications Manager software to a version that includes patches for this vulnerability.

What versions of Cisco Unified Communications Manager are affected by CVE-2010-3039?

CVE-2010-3039 affects Cisco Unified Communications Manager versions 6.x, 7.x, and 8.x.

Is CVE-2010-3039 exploitable without authentication?

No, CVE-2010-3039 requires authentication, meaning that the attacker must have valid credentials to exploit the vulnerability.

What impact does CVE-2010-3039 have on affected systems?

The impact of CVE-2010-3039 allows an authenticated attacker to execute arbitrary commands, potentially compromising sensitive information or system functionality.