CVE-2011-4487: SQL Injection
Published Mar 1, 2012
·Updated
SQL injection vulnerability in Cisco Unified Communications Manager (CUCM) with software 6.x and 7.x before 7.1(5b)su5, 8.0 before 8.0(3a)su3, and 8.5 and 8.6 before 8.6(2a)su1 and Cisco Business Edition 3000 with software before 8.6.3 and 5000 and 6000 with software before 8.6(2a)su1 allows remote attackers to execute arbitrary SQL commands via a crafted SCCP registration, aka Bug ID CSCtu73538.
Affected Software
93 affected components
Cisco Unified Communications Manager=6.1\(3a\)
Cisco Unified Communications Manager=6.1\(2\)
Cisco Unified Communications Manager=6.1\(3b\)su1
Cisco Unified Communications Manager=6.0\(1\)
Cisco Unified Communications Manager=6.1\(2\)su1a
Cisco Unified Communications Manager=6.1\(4\)su1
Cisco Unified Communications Manager=6.1\(4\)
Cisco Unified Communications Manager=6.1\(5\)su1
Cisco Unified Communications Manager=6.1\(4a\)
Cisco Unified Communications Manager=6.1\(5\)su2
Cisco Unified Communications Manager=6.1\(3\)
Cisco Unified Communications Manager=6.1\(4a\)su2
Cisco Unified Communications Manager=6.1\(1\)
Cisco Unified Communications Manager=6.1\(1b\)
Cisco Unified Communications Manager=6.1\(3b\)
Cisco Unified Communications Manager=6.1\(5\)
Cisco Unified Communications Manager=6.1\(5\)su3
Cisco Unified Communications Manager=6.0\(1a\)
Cisco Unified Communications Manager=6.0\(1b\)
Cisco Unified Communications Manager=6.1\(2\)su1
Cisco Unified Communications Manager=6.0
Cisco Unified Communications Manager=6.1\(1a\)
Cisco Unified Communications Manager=7.1\(2b\)su1
Cisco Unified Communications Manager=7.1\(2b\)
Cisco Unified Communications Manager=7.1\(5b\)su4
Cisco Unified Communications Manager=7.1\(3b\)
Cisco Unified Communications Manager=7.1\(2a\)su1
Cisco Unified Communications Manager=7.1\(3b\)su1
Cisco Unified Communications Manager=7.1\(3a\)su1a
Cisco Unified Communications Manager=7.1\(5b\)su1
Cisco Unified Communications Manager=7.1\(5b\)su3
Cisco Unified Communications Manager=7.1\(3\)
Cisco Unified Communications Manager=7.1\(2a\)
Cisco Unified Communications Manager=7.1\(5b\)
Cisco Unified Communications Manager=7.0\(2a\)
Cisco Unified Communications Manager=7.0\(1\)su1
Cisco Unified Communications Manager=7.0\(1\)su1a
Cisco Unified Communications Manager=7.1\(5b\)su2
Cisco Unified Communications Manager=7.1\(5\)
Cisco Unified Communications Manager=7.1\(5a\)
Cisco Unified Communications Manager=7.0\(2a\)su2
Cisco Unified Communications Manager=7.1\(5b\)su1a
Cisco Unified Communications Manager=7.1\(5\)su1a
Cisco Unified Communications Manager=7.1\(5\)su1
Cisco Unified Communications Manager=7.1\(3a\)
Cisco Unified Communications Manager=7.0\(2a\)su1
Cisco Unified Communications Manager=7.1\(3a\)su1
Cisco Unified Communications Manager=7.0\(2\)
Cisco Unified Communications Manager=7.1\(3b\)su2
Cisco Unified Communications Manager=8.0\(2c\)
Cisco Unified Communications Manager=8.0\(2\)
Cisco Unified Communications Manager=8.0\(2b\)
Cisco Unified Communications Manager=8.0\(3a\)su2
Cisco Unified Communications Manager=8.0
Cisco Unified Communications Manager=8.0\(3\)
Cisco Unified Communications Manager=8.0\(2a\)
Cisco Unified Communications Manager=8.0\(3a\)
Cisco Unified Communications Manager=8.0\(2c\)su1
Cisco Unified Communications Manager=8.0\(1\)
Cisco Unified Communications Manager=8.0\(3a\)su1
Cisco Unified Communications Manager=8.5\(1\)
Cisco Unified Communications Manager=8.5\(1\)su2
Cisco Unified Communications Manager=8.5\(1\)su3
Cisco Unified Communications Manager=8.5
Cisco Unified Communications Manager=8.5\(1\)su1
Cisco Unified Communications Manager=8.6\(1\)
Cisco Unified Communications Manager=8.6\(2\)
Cisco Unified Communications Manager=8.6\(2a\)
Cisco Unified Communications Manager=8.6
Cisco Unified Communications Manager=8.6\(1a\)
Cisco Business Edition 3000 Software=8.6\(1\)
Cisco Business Edition 3000 Software=8.6\(1a\)
Cisco Business Edition 3000 Software=8.6\(2a\)
Cisco Business Edition 3000 Software=8.6.2
Cisco Business Edition 3000
Cisco Business Edition 5000 Software=8.5
Cisco Business Edition 5000 Software=8.5\(1\)
Cisco Business Edition 5000 Software=8.6
Cisco Business Edition 5000 Software=8.6\(1\)
Cisco Business Edition 5000 Software=8.6\(1a\)
Cisco Business Edition 5000 Software=8.6\(2\)
Cisco Business Edition 5000 Software=8.6\(2a\)
Cisco Business Edition 5000
Cisco Business Edition 6000 Software=8.5\(1\)
Cisco Business Edition 6000 Software=8.5\(1\)su1
Cisco Business Edition 6000 Software=8.5\(1\)su2
Cisco Business Edition 6000 Software=8.5\(1\)su3
Cisco Business Edition 6000 Software=8.5\(1-2011o\)
Cisco Business Edition 6000 Software=8.6\(1\)
Cisco Business Edition 6000 Software=8.6\(1a\)
Cisco Business Edition 6000 Software=8.6\(2\)
Cisco Business Edition 6000 Software=8.6\(2a\)
Cisco Business Edition 6000
Event History
Mar 1, 2012
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2011-4487?
CVE-2011-4487 is considered a critical vulnerability due to its potential for remote exploitation.
2
How do I fix CVE-2011-4487?
To resolve CVE-2011-4487, ensure that your Cisco Unified Communications Manager is updated to a version that contains the security patches provided by Cisco.
3
What software versions are affected by CVE-2011-4487?
CVE-2011-4487 affects Cisco Unified Communications Manager versions 6.x, 7.x, and specific versions of Cisco Business Edition 3000, 5000, and 6000.
4
Can CVE-2011-4487 be exploited remotely?
Yes, CVE-2011-4487 allows remote attackers to exploit a SQL injection vulnerability without authentication.
5
Is there a workaround for CVE-2011-4487?
While upgrading is the recommended fix, restricting access to affected servers and implementing firewall rules can serve as temporary mitigating controls for CVE-2011-4487.