Cisco Unified Communications Manager SIP Service Multiple Denial of Service Vulnerabilities

Bugtraq ID:	31367
Class:	Unknown
CVE:	CVE-2008-3800 CVE-2008-3801
Remote:	Yes
Local:	No
Published:	Sep 24 2008 12:00AM
Updated:	Apr 09 2009 07:06PM
Credit:	The vendor reported these issues.
Vulnerable:	Cisco Unified Communications Manager 6.1(2) Cisco Unified Communications Manager 6.1(1a) Cisco Unified Communications Manager 6.1(1) Cisco Unified Communications Manager 6.1 Cisco Unified Communications Manager 6.0(1) Cisco Unified Communications Manager 6.0 (1a) Cisco Unified Communications Manager 6.0 Cisco Unified Communications Manager 5.1(3C) Cisco Unified Communications Manager 5.1(3a) Cisco Unified Communications Manager 5.1(3) Cisco Unified Communications Manager 5.1(2b) Cisco Unified Communications Manager 5.1(2a) Cisco Unified Communications Manager 5.1(2) Cisco Unified Communications Manager 5.1(1) Cisco Unified Communications Manager 5.0 Cisco Unified Communications Manager 4.3(2)SR1 Cisco Unified Communications Manager 4.3(2) Cisco Unified Communications Manager 4.3(1)Sr.1 Cisco Unified Communications Manager 4.3 Cisco Unified Communications Manager 4.2(3)sr2 Cisco Unified Communications Manager 4.2 (3)SR4 Cisco Unified Communications Manager 4.2 (3)SR3 Cisco Unified Communications Manager 4.2 (3)SR2b Cisco Unified CallManager 6.0 Cisco Unified CallManager 5.1 Cisco Unified CallManager 5.0(4a)SU1 Cisco Unified CallManager 5.0(4) Cisco Unified CallManager 5.0(3a) Cisco Unified CallManager 5.0(3) Cisco Unified CallManager 5.0(2) Cisco Unified CallManager 5.0(1) Cisco Unified CallManager 5.0 Cisco Unified CallManager 5.0 Cisco Unified CallManager 5.0 Cisco Unified CallManager 4.3(1)sr1 Cisco Unified CallManager 4.2(3)sr2 Cisco Unified CallManager 4.2(3)SR1 Cisco Unified CallManager 4.2 Cisco Unified CallManager 4.1(3)SR7 Cisco Unified CallManager 4.1(3)sr5 Cisco Unified CallManager 4.1(3)sr5 Cisco Unified CallManager 4.1(3)SR4 Cisco Unified CallManager 4.1 (3)SR5c Cisco Unified CallManager 4.1 (3)SR5b Cisco Unified CallManager 4.1 Cisco Call Manager 4.1 (3)SR2 Cisco Call Manager 4.1 (3)SR1 Cisco Call Manager 4.1 (3)ES32 Cisco Call Manager 4.1 (3)ES24 Cisco Call Manager 4.1 (3)ES07 Cisco Call Manager 4.1 (2)ES55 Cisco Call Manager 4.1 (2)ES50 Cisco Call Manager 4.1 (2)ES33 Cisco Call Manager 5.1 Cisco Call Manager 4.3(1) Cisco Call Manager 4.2(3) Cisco Call Manager 4.1(3)SR4
Not Vulnerable:	Cisco Unified Communications Manager 6.1 (3b)su1 Cisco Unified Communications Manager 6.1 (2)su1 Cisco Unified Communications Manager 5.1(3d) Cisco Unified Communications Manager 5.1 (3e) Cisco Unified CallManager 4.3(2)SR1b Cisco Unified CallManager 4.3(2)SR1a Cisco Unified CallManager 4.2(3)SR4b Cisco Unified CallManager 4.1(3)SR8a Cisco Unified CallManager 4.1(3)SR8

Cisco Unified Communications Manager SIP Service Multiple Denial of Service Vulnerabilities

Cisco Unified Communications Manager is prone to multiple denial-of-service vulnerabilities.

These issues affect the Session Initiation Protocol (SIP) service.

These issues are documented by Cisco bug IDs CSCsu38644 and CSCsm46064.

An attacker can exploit these issues to cause denial-of-service conditions in the affected application.

Cisco Unified Communications Manager SIP Service Multiple Denial of Service Vulnerabilities

To exploit these issues, attackers can use readily available network utilities.

Cisco Unified Communications Manager SIP Service Multiple Denial of Service Vulnerabilities

Solution:
The vendor has released updates. Please see the referenced advisory for more information.

Cisco Unified Communications Manager SIP Service Multiple Denial of Service Vulnerabilities

References:

• Cisco Homepage (Cisco )
  
• Cisco Security Advisory: Cisco Unified Communications Manager Session Initiation (Cisco Systems Product Security Incident Response Team )
  
• cisco-sa-20080924-cucm Cisco Security Advisory: Cisco Unified Communications Man (Cisco)