Two vulnerabilities have been reported in Cisco Unified Contact Center Express, which can be exploited by malicious people to disclose potentially sensitive information and cause a DoS (Denial of Service).

1) An error when handling messages within the Computer Telephony Integration (CTI) component can be exploited to cause a temporary server failure via a specially crafted message sent to e.g. TCP port 42027.

2) An error in parsing bootstrap messages can be exploited to disclose the contents of arbitrary files via a specially crafted messages containing directory traversal sequences sent to TCP port 6295.

Successful exploitation requires that high-availability deployment model is used.

The vulnerabilities affect Cisco Unified Contact Center Express running the following software:
* Cisco UCCX versions 5.x, 6.x, and 7.x
* Cisco Customer Response Solution (CRS) versions 5.x, 6.x, and 7.x
* Cisco Unified IP Interactive Voice Response (Cisco Unified IP IVR) versions 5.x, 6.x, and 7.x

Solution
Update Cisco UCCX to the fixed version (please see the vendor's advisories for details).

Provided and/or discovered by
Reported by the vendor.

Original Advisory
http://www.cisco.com/warp/public/707/cisco-sa-20100609-uccx.shtml

Deep Links
Links available in Customer Area