CVE-2019-9971
First published: Tue Jun 07 2022(Updated: )
PhoneSystem Terminal in 3CX Phone System (Debian based installation) 16.0.0.1570 allows an attacker to gain root privileges by using sudo with the tcpdump command, without a password. This occurs because the -z (aka postrotate-command) option to tcpdump can be unsafe when used in conjunction with sudo.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| 3cx Phone System Firmware | =16.0.0.1570 | |
| 3CX Phone System | ||
| Debian Debian Linux |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2019-9971.
What is the severity of CVE-2019-9971?
The severity of CVE-2019-9971 is critical with a CVSS score of 8.8.
How can an attacker exploit CVE-2019-9971?
An attacker can exploit CVE-2019-9971 by using sudo with the tcpdump command without a password.
What is the affected software of CVE-2019-9971?
The affected software is 3CX Phone System (Debian based installation) version 16.0.0.1570.
Is 3CX Phone System (non-Debian based installation) vulnerable to CVE-2019-9971?
No, 3CX Phone System (non-Debian based installation) is not vulnerable to CVE-2019-9971.
- collector/nvd-index
- agent/weakness
- agent/references
- agent/severity
- agent/author
- agent/type
- agent/description
- agent/event
- agent/softwarecombine
- agent/last-modified-date
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/3cx
- canonical/3cx phone system firmware
- version/3cx phone system firmware/16.0.0.1570
- canonical/3cx phone system
- vendor/debian
- canonical/debian debian linux