Information disclosure in Nortel Business Communications Manager
CVE-2007-5637
The Nortel UNIStim IP Softphone 2050, IP Phone 1140E, and additional Nortel products from the IP Phone, Business Communications Manager (BCM), and other product lines allow remote attackers to eavesdrop on the physical environment via an Open Audio Stream message that enables "surveillance mode." NOTE: issues relating to a small ID number space can be leveraged to make this attack easier.
Vulnerability class: Information Disclosure
Published · last modified .
CVSS v2 metric
CVSS v2 base score 4.3 (Medium). Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.031 (87.9th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 88th percentile — 87.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.031 · newest: 0.031 · change: 0.000
Affected products
- Nortel Business Communications Manager — versions 50, 50a, 50e
- Nortel Centrex Ip Client Manager
- Nortel Centrex Ip Element Manager
- Nortel Communications Server — versions 1000e, 1000m, 1000s
- Nortel Ip Audio Conference Phone 2033
- Nortel Ip Phone 1110
- Nortel Ip Phone 1120e
- Nortel Ip Phone 1140e
- Nortel Ip Phone 1150e
- Nortel Ip Phone 2001
Weakness classification (CWE)
References
- exchange.xforce.ibmcloud.com/vulnerabilities/37255 (vdb-entry)
- osvdb.org/41769 (vdb-entry)
- secunia.com/advisories/27234 (Vendor Advisory, third-party-advisory)
- www.csnc.ch/static/advisory/csnc/nortel_IP_phone_surveillance_mode_v1.0.txt
- www116.nortel.com/pub/repository/CLARIFY/DOCUMENT/2007/42/022870-01.pdf
- support.nortel.com/go/main.jsp (Patch)
- securityreason.com/securityalert/3272 (third-party-advisory)
- www.securityfocus.com/archive/1/482478/100/0/threaded (mailing-list)
- www.securityfocus.com/bid/26120 (Exploit, Patch, vdb-entry)