Cisco Security Advisory – Cisco Unified Communications Manager, formerly CallManager, contains a privilege escalation vulnerability in the IP Phone Personal Address Book (PAB) Synchronizer feature that may allow an attacker to gain complete administrative access to a vulnerable Cisco Unified Communications Manager system. If Cisco Unified Communications Manager is integrated with an external directory service, it may be possible for an attacker to leverage the privilege escalation vulnerability to gain access to additional systems configured to use the directory service for authentication.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/75642/cisco-sa-20090311-cucmpab.txt
Source: https://packetstormsecurity.com/files/75642/Cisco-Security-Advisory-20090311-cucmpab.html