Cisco Unified Communications Manager SIP Message (CVE-2010-2838) Denial of Service Vulnerability

Bugtraq ID:	42698
Class:	Design Error
CVE:	CVE-2010-2838
Remote:	Yes
Local:	No
Published:	Aug 25 2010 12:00AM
Updated:	Mar 19 2015 09:27AM
Credit:	Cisco
Vulnerable:	Cisco Unified Communications Manager 8.0(1) Cisco Unified Communications Manager 8.0(0.98000.106) Cisco Unified Communications Manager 7.1(3b)su2 Cisco Unified Communications Manager 7.1(3b)su1 Cisco Unified Communications Manager 7.1(3a)su1 Cisco Unified Communications Manager 7.1(2a)su1 Cisco Unified Communications Manager 7.1(2) Cisco Unified Communications Manager 7.1 Cisco Unified Communications Manager 7.0(2a)su1 Cisco Unified Communications Manager 7.0(2) Cisco Unified Communications Manager 7.0
Not Vulnerable:	Cisco Unified Communications Manager 8.0(3) Cisco Unified Communications Manager 7.1(5) Cisco Unified Communications Manager 7.0(2a)SU3

Cisco Unified Communications Manager SIP Message (CVE-2010-2838) Denial of Service Vulnerability

Cisco Unified Communications Manager is prone to a denial-of-service vulnerability.

An attacker can exploit this issue to cause an interruption in voice services, denying service to legitimate users.

This issue is tracked by Cisco Bug ID CSCtf66305.

Cisco Unified Communications Manager SIP Message (CVE-2010-2838) Denial of Service Vulnerability

To exploit this issue, attackers can use readily available network utilities.

Cisco Unified Communications Manager SIP Message (CVE-2010-2838) Denial of Service Vulnerability

Solution:
The vendor has released updates. Please see the referenced advisory for details.

Cisco Unified Communications Manager SIP Message (CVE-2010-2838) Denial of Service Vulnerability

References:

• Cisco Unified Communication Manager Homepage (Cisco)
  
• Cisco Security Advisory: Cisco Unified Communications Manager Denial of Service (Cisco)