Cisco CallManager CCM.EXE Remote Denial Of Service Vulnerability

Bugtraq ID:	14252
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 12 2005 12:00AM
Updated:	Jul 12 2005 12:00AM
Credit:	The vendor disclosed this vulnerability.
Vulnerable:	Cisco Call Manager 4.0 Cisco Call Manager 3.3 (3) Cisco Call Manager 3.3 Cisco Call Manager 3.2 + Cisco VoIP Phone 7902G 0 + Cisco VoIP Phone 7905G 0 + Cisco VoIP Phone 7912G 0 Cisco Call Manager 3.1 (3a) Cisco Call Manager 3.1 (2) Cisco Call Manager 3.1 Cisco Call Manager 3.0 Cisco Call Manager 2.0 Cisco Call Manager 1.0
Not Vulnerable:	Cisco Call Manager 4.1 (3)SR1 Cisco Call Manager 4.1 (3)ES07 Cisco Call Manager 4.1 (2)ES33 Cisco Call Manager 4.0 (2a)SR2b Cisco Call Manager 4.0 (2a)ES40 Cisco Call Manager 3.3 (5) Cisco Call Manager 3.3 (4)ES25 Cisco Call Manager 3.3 (3)ES61

Cisco CallManager CCM.EXE Remote Denial Of Service Vulnerability

The CallManager 'ccm.exe' process is susceptible to a remote denial of service vulnerability.

This issue is documented in Cisco bug CSCee00118, which is available to Cisco customers.

This issue may be exploited to cause the affected application to restart, denying service to legitimate users.

This issue was originally documented in BID 14227.

Cisco CallManager CCM.EXE Remote Denial Of Service Vulnerability

No exploit is required.

Cisco CallManager CCM.EXE Remote Denial Of Service Vulnerability

Solution:
Cisco has released an advisory, along with fixes to address this, and other issues. Please see the referenced advisory for further details, and information on obtaining fixes.

Cisco CallManager CCM.EXE Remote Denial Of Service Vulnerability

References:

• CallManager Product Page (Cisco)
  
• Cisco CallManager Memory Handling Vulnerabilities (Cisco)