Cisco Unified Presence and Jabber XCP CVE-2012-3935 Denial of Service Vulnerability

Bugtraq ID:	55514
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2012-3935
Remote:	Yes
Local:	No
Published:	Sep 12 2012 12:00AM
Updated:	Sep 12 2012 12:00AM
Credit:	Cisco
Vulnerable:	Cisco Unified Presence Server 8.6 Cisco Unified Presence Server 8.5 Cisco Unified Presence Server 8.0 Cisco Unified Presence Server 7.0(8) Cisco Unified Presence Server 7.0(4) Cisco Unified Presence Server 7.0 Cisco Unified Presence Server 6.0(7) Cisco Unified Presence Server 6.0(6) Cisco Unified Presence Server 6.0(3) Cisco Unified Presence Server 6.0(2) Cisco Unified Presence Server 6.0(1) Cisco Unified Presence Server 6.0 Cisco Unified Presence Server 1.0(3) Cisco Unified Presence Server 1.0(2) Cisco Unified Presence Server 1.0 Cisco Jabber XCP 5.2 Cisco Jabber XCP 5.1 Cisco Jabber XCP 5.0 Cisco Jabber XCP 4.0 Cisco Jabber XCP 3.0 Cisco Jabber XCP 2.0
Not Vulnerable:

Cisco Unified Presence and Jabber XCP CVE-2012-3935 Denial of Service Vulnerability

Cisco Unified Presence and Jabber XCP are prone to a denial-of-service vulnerability.

Successful exploits will allow attackers to crash the Connection Manager process, denying service to legitimate users.

This issue is being tracked by the Cisco Bug ID CSCtu32832.

Cisco Unified Presence and Jabber XCP CVE-2012-3935 Denial of Service Vulnerability

An attacker can use readily available network utilities to exploit this issue.

Cisco Unified Presence and Jabber XCP CVE-2012-3935 Denial of Service Vulnerability

Solution:
The vendor has released an update. Please see the references for details.

Cisco Unified Presence and Jabber XCP CVE-2012-3935 Denial of Service Vulnerability

References:

• Cisco Unified Presence Homepage (Cisco)
  
• Jabber Extensible Communications Platform (XCP) (Cisco)