Description
The native Unity authentication implemented on the web interface can bypassed to gain unauthorized access to a variety of resources. The first time you attempt connecting to any of the specific links you are redirected to the authentication page. However, any subsequent attempts are then successful even without having entered valid login credentials resulting in either the ability to view information or edit the configuration.
Recommendations
Cisco has acknowledged the issue and is issuing patches to correct it. More details could be found in Cisco Security Advisory, Advisory ID: cisco-sa-20081008-unity at http://www.cisco.com/en/US/products/products_security_advisory09186a0080a0d85f.shtml and http://www.cisco.com/warp/public/707/cisco-sr-20081008-unity.shtml. In the short term it is recommended that a VoIP aware IPS product, such as VoIPguard, with signatures to detect attempts to exploit this issue, be implemented to prevent it from being exploited. Implementing best practices can limit the exposure of this issue. Cisco is recommending to use Unity integrated login feature. Cisco customers with a valid support agreement may wish to speak with their support contact in order to obtain further vendor details.