Cisco Unified Communications Manager Privilege Escalation

` nSense Vulnerability Research Security Advisory NSENSE-2010-003  
---------------------------------------------------------------  
  
Affected Vendor: Cisco Systems, Inc  
Affected Product: Cisco Unified Communications Manager  
Platform: All  
Impact: Privilege Escalation  
Vendor response: Patch. IntelliShield ID 21656  
CVE: CVE-2010-3039  
Credit: Knud / nSense  
  
Technical details  
---------------------------------------------------------------  
  
Cisco Unified Communications Manager contains a setuid binary  
which fails to validate command line arguments. A local user  
can leverage this vulnerability to gain root access by  
supplying suitable arguments to the binary.  
  
The application also contains unsafe function calls, such as  
sprintf().  
  
Proof of concept:  
/usr/local/cm/bin/pktCap_protectData -i";id"  
  
Timeline:  
Aug 21st Contacted vendor PSIRT  
Aug 23rd Vendor response. Vulnerability acknowledged  
Aug 23rd More information sent to vendor  
Sep 2nd Status update request sent to vendor  
Sep 2nd Vendor response  
Sep 3rd Vendor response. More information provided.  
Sep 22nd Status update request sent to vendor  
Sep 22nd Vendor response  
Sep 23rd Vendor response. New release date suggested  
Sep 23rd Agreed to the October 20th release date  
Sep 23rd Vendor response  
Oct 6th Requested schedule information from vendor  
Oct 6th Vendor response. New release date suggested  
Oct 6th Sent counterproposal to vendor  
Oct 6th Vendor response. Requested Wednesday release  
Oct 7th Agreed to the new release date  
Oct 7th Vendor response  
Nov 3rd Vendor confirms release and sends link  
Nov 5th Advisory published  
  
A thank you to Matthew Cerha / Cisco PSIRT for the coordination  
effort.  
  
"Remember, remember the Fifth of November"  
  
Links:  
http://tools.cisco.com/security/center/viewAlert.x?alertId=21656  
  
http://www.nsense.fi http://www.nsense.dk  
  
  
  
$$s$$$$s. ,s$$$$s ,S$$$$$s. $$s$$$$s. ,s$$$$s ,S$$$$$s.  
$$$ `$$$ ($$( $$$ `$$$ $$$ `$$$ ($$( $$$ `$$$  
$$$ $$$ `^$$s. $$$$$$$$$ $$$ $$$ `^$$s. $$$$$$$$$  
$$$ $$$ )$$) $$$ $$$ $$$ )$$) $$$  
$$$ $$$ ^$$$$$$7 `7$$$$$P $$$ $$$ ^$$$$$$7 `7$$$$$P  
  
D r i v e n b y t h e c h a l l e n g e _  
  
`