Local Users Can Access Encrypted Passwords in Cisco Videoconferencing Products

CVE-2010-4303

Summary

The Cisco Unified Videoconferencing System 5110 and 5115 running on Linux has a serious vulnerability due to world-readable permissions for the /etc/shadow file. This misconfiguration permits local users to read sensitive encrypted passwords, potentially compromising user accounts and exposing the system to unauthorized access. Organizations using these videoconferencing systems should take immediate action to secure the /etc/shadow file and prevent local access to sensitive credential information.

References