|
|
>> Cisco Unified Communications Manager Code Execution and DoS Issues
|
Title : Cisco Unified Communications Manager Code Execution and DoS Issues
Advisory ID : VUPEN/ADV-2007-3532
CVE ID : CVE-2007-5537 - CVE-2007-5538
Rated as : Moderate Risk 
Remotely Exploitable : Yes
Locally Exploitable : Yes
Release Date : 2007-10-18
|
|
Multiple vulnerabilities have been identified in Cisco Unified Communications Manager (CUCM), formerly CallManager, which could be exploited by attackers to cause a denial of service or execute arbitrary code.
The first issue is caused by an error in the Session Initiation Protocol (SIP) stack when processing a flood of SIP INVITE messages sent to port 5060/UDP, which could be exploited by attackers to trigger a resource exhaustion condition that will result in a kernel panic.
The second vulnerability is caused by a buffer overflow error in the Centralized TFTP File Locator Service component of the CUCM TFTP service when processing specially crafted filenames, which could be exploited by unauthenticated attackers to cause a denial of service or execute arbitrary code. The CUCM TFTP service disabled by default.
Credits
Vulnerabilities reported by the vendor.
ChangeLog
2007-10-18 : Initial release
Vulnerability Management
Subscribe to VUPEN Security VNS and receive real-time e-mail and SMS alerts when new advisories or patches relevant to your systems and network configurations are available.
Feedback
If you have additional information or corrections for this security advisory please submit them via our contact form. | |
|
