Cisco Unity Connection SQL injection vulnerability in CVE-2014-3336)

Cisco Unity Connection SQL injection vulnerability in CVE-2014-3336)

Release date:
Updated on:

Affected Systems:
Cisco Unity Connection
Description:
--------------------------------------------------------------------------------
Bugtraq id: 69163
CVE (CAN) ID: CVE-2014-3336
 
Cisco Unity Connection transparently integrates the messaging and speech recognition components with your data network to provide uninterrupted access to calls and messages.
 
The Web Framework Code of Cisco Unity Connection has the SQL injection vulnerability. authenticated remote attackers send specially crafted requests to the affected Web server, this vulnerability allows you to execute arbitrary queries in the database to read data subsets of the database.
 
<* Source: Cisco
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:
 
Cisco
-----
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:
 
Http://www.cisco.com/web/CN/products/products_netsol/voices/products/unity_connection/index.html

This article permanently updates the link address: