Cisco Unified Presence Engine Service Malformed IP Packets Denial of Service Vulnerability

Bugtraq ID:	29219
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2008-1158
Remote:	Yes
Local:	No
Published:	May 14 2008 12:00AM
Updated:	May 14 2008 11:55PM
Credit:	The vendor disclosed this vulnerability.
Vulnerable:	Cisco Unified Presence Server 6.0 Cisco Unified Presence Server 1.0(3) Cisco Unified Presence Server 1.0(2) Cisco Unified Presence Server 1.0 Cisco Unified Presence Server 1.0
Not Vulnerable:	Cisco Unified Presence Server 6.0(1)

Cisco Unified Presence Engine Service Malformed IP Packets Denial of Service Vulnerability

Cisco Unified Presence is prone to a denial-of-service vulnerability that occurs in the Presence Engine service.

An attacker can exploit this issue to crash the affected device, denying service to legitimate users.

Cisco Unified Presence Engine Service Malformed IP Packets Denial of Service Vulnerability

An attacker can use readily available network utilities to exploit this issue.

Cisco Unified Presence Engine Service Malformed IP Packets Denial of Service Vulnerability

Solution:
The vendor has released an update. Please see the references for more information.

Cisco Unified Presence Engine Service Malformed IP Packets Denial of Service Vulnerability

References:

• Cisco Homepage (Cisco )
  
• Cisco Unified Presence Homepage (Cisco)
  
• Cisco Security Advisory: Cisco Unified Presence Denial of Service Vulnerabilitie (Cisco Systems Product Security Incident Response Team )
  
• Cisco Security Advisory: Cisco Unified Presence Denial of Service Vulnerabilitie (Cisco)