CVE-2002-1189

MediumCVSS 4.6/10Last modified Jun 16, 2026

Description

The default configuration of Cisco Unity 2.x and 3.x does not block international operator calls in the predefined restriction tables, which could allow authenticated users to place international calls using call forwarding.

Metrics

CVSS 2.0 4.6/10AV:L/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.cisco.com/warp/public/707/toll-fraud-pub.shtmlPatch, Vendor Advisory
http://www.iss.net/security_center/static/10282.phpVendor Advisory
http://www.securityfocus.com/bid/5896
http://www.cisco.com/warp/public/707/toll-fraud-pub.shtmlPatch, Vendor Advisory
http://www.iss.net/security_center/static/10282.phpVendor Advisory
http://www.securityfocus.com/bid/5896

Timeline

Published: Oct 11, 2002
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2002

CVE-2002-11907.5Cisco Unity 2.x and 3.x uses well-known default user accounts, which could allow remote attackers to gain access and place arbitrary calls.CVE-2002-11915.0The Sabserv client component in Sabre Desktop Reservation Software 4.2 through 4.4 allows remote attackers to cause a denial of service via CVE-2002-11924.6Multiple buffer overflows in rogue on NetBSD 1.6 and earlier, FreeBSD 4.6, and possibly other operating systems, allows local users to gain CVE-2002-11932.1tkmail before 4.0beta9-8.1 allows local users to create or overwrite files as users via a symlink attack on temporary files.CVE-2002-11947.5Buffer overflow in talkd on NetBSD 1.6 and earlier, and possibly other operating systems, may allow remote attackers to execute arbitrary co CVE-2002-11954.3Cross-site scripting vulnerability (XSS) in the PHP interface for ht://Check 1.1 allows remote web servers to insert arbitrary HTML, includi CVE-2002-11967.5editproducts.cgi in Bugzilla 2.14.x before 2.14.4, and 2.16.x before 2.16.1, when the "usebuggroups" feature is enabled and more than 47 gro CVE-2002-11977.5bugzilla_email_append.pl in Bugzilla 2.14.x before 2.14.4, and 2.16.x before 2.16.1, allows remote attackers to execute arbitrary code via s CVE-2002-11987.5Bugzilla 2.16.x before 2.16.1 does not properly filter apostrophes from an email address during account creation, which allows remote attack CVE-2002-11995.0The getdbm procedure in ypxfrd allows local users to read arbitrary files, and remote attackers to read databases outside /var/yp, via a dir CVE-2002-12007.5Balabit Syslog-NG 1.4.x before 1.4.15, and 1.5.x before 1.5.20, when using template filenames or output, does not properly track the size of CVE-2002-12015.0IBM AIX 4.3.3 and AIX 5 allows remote attackers to cause a denial of service (CPU consumption or crash) via a flood of malformed TCP packets