<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Paul,<br>
This is what i was getting at:<br>
<br>
CSCed03134 CME http directory traversal vulnerability with matched
enable psswd<br>
<br>
Symptom:<br>
<br>
When a Cisco device is running IOS and configured for CallManager
Express (CME) or ITS, The URL <br>
<a class="moz-txt-link-freetext" href="http://x.x.x.x/telephony-service">http://x.x.x.x/telephony-service</a> allows configuration of CME/ITS
parameters.<br>
<br>
Condition:<br>
<br>
The user can browse to the device and, with the enable password, can
make changes to CME/ITS <br>
settings.<br>
<br>
Workaround: <br>
<br>
Configure local or AAA authentication:<br>
<br>
"ip http authentication [local | tacacs]"<br>
<br>
/Wes<br>
<br>
Wes Sisk wrote:
<blockquote cite="mid:47A73F6A.9030903@cisco.com" type="cite">
<pre wrap="">Is the user's password the same as the IOS secret passwd?
/wes
Paul Choi wrote:
</pre>
<blockquote type="cite">
<pre wrap="">CCME 4.1
12.4(15)T1
Hi there, as the title says, I login as a regular
non-admin user to the CCME GUI and the user has admin
privileges. I had another installation with a similar
setup but the user logins worked without issue. Does
anybody know what I'm doing wrong or if this is a bug?
Help!
Paul
____________________________________________________________________________________
Looking for last minute shopping deals?
Find them fast with Yahoo! Search. <a class="moz-txt-link-freetext" href="http://tools.search.yahoo.com/newsearch/category.php?category=shopping">http://tools.search.yahoo.com/newsearch/category.php?category=shopping</a>
_______________________________________________
cisco-voip mailing list
<a class="moz-txt-link-abbreviated" href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a>
<a class="moz-txt-link-freetext" href="https://puck.nether.net/mailman/listinfo/cisco-voip">https://puck.nether.net/mailman/listinfo/cisco-voip</a>
</pre>
</blockquote>
<pre wrap=""><!---->_______________________________________________
cisco-voip mailing list
<a class="moz-txt-link-abbreviated" href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a>
<a class="moz-txt-link-freetext" href="https://puck.nether.net/mailman/listinfo/cisco-voip">https://puck.nether.net/mailman/listinfo/cisco-voip</a>
</pre>
</blockquote>
</body>
</html>