Next Page >>
Cisco Unified Communications Manager
+---------------------------------------------------------------------
Summary
=======
Cisco Unified Communications Manager, formerly CallManager, contains
a privilege escalation vulnerability in the IP Phone Personal Address
Book (PAB) Synchronizer feature that may allow an attacker to gain
complete administrative access to a vulnerable Cisco Unified
Communications Manager system. If Cisco Unified Communications
Manager is integrated with an external directory service, it may be
+---------------------------------------------------------------------
Summary
=======
Cisco Unified Communications Manager, formerly Cisco CallManager,
contains multiple denial of service (DoS) vulnerabilities that may
cause an interruption in voice services, if exploited. These
vulnerabilities were discovered internally by Cisco. The following
Cisco Unified Communications Manager services are affected:
+---------------------------------------------------------------------
Summary
=======
Cisco Unified Communications Manager, formerly Cisco CallManager,
contains multiple denial of service (DoS) vulnerabilities that may
cause an interruption in voice services, if exploited. These
vulnerabilities were discovered internally by Cisco. The following
Cisco Unified Communications Manager services are affected:
Summary
=======
Cisco Unified Communications Manager, formerly Cisco Unified
CallManager, contains two denial of service (DoS) vulnerabilities in
the Session Initiation Protocol (SIP) service. An exploit of these
vulnerabilities may cause an interruption in voice services.
Cisco will release free software updates that address these
vulnerabilities and this advisory will be updated as fixed software
* Step 1: Log into the Cisco Unified Communications Manager
Administration Interface.
* Step 2: Navigate to System > Service Parameters and select the
appropriate Cisco Unified Communications Manager server and the
Cisco CallManager service.
* Step 3: Change the SIP Interoperability Enabled parameter to
False, and click Save.
Note: For a SIP processing change to take effect, the Cisco
CallManager service must be restarted. For information on how to
Summary
=======
Cisco Unified Communications Manager (previously known as Cisco
CallManager) contains the following vulnerabilities:
* Three (3) denial of service (DoS) vulnerabilities that affect
Session Initiation Protocol (SIP) services
* Directory transversal vulnerability
* Two (2) SQL injection vulnerabilities
+---------------------------------------------------------------------
Summary
=======
Cisco Unified Communications Manager (formerly Cisco CallManager)
contains multiple denial of service (DoS) vulnerabilities that if
exploited could cause an interruption of voice services. The Session
Initiation Protocol (SIP), Skinny Client Control Protocol (SCCP) and
Computer Telephony Integration (CTI) Manager services are affected by
these vulnerabilities.
- ---------------------------------------------------------------------
Summary
=======
Cisco Unified Communications Manager (CUCM), formerly CallManager,
contains a heap overflow vulnerability in the Certificate Trust List
(CTL) Provider service that could allow a remote, unauthenticated
user to cause a denial of service (DoS) condition or execute
arbitrary code. There is a workaround for this vulnerability.
+---------------------------------------------------------------------
Summary
=======
Cisco Unified Communications Manager (formerly CallManager) contains
multiple denial of service (DoS) vulnerabilities that if exploited
could cause an interruption to voice services. The Session Initiation
Protocol (SIP) and Skinny Client Control Protocol (SCCP) services are
affected by these vulnerabilities.
Summary
=======
Cisco Unified Communications Manager (CUCM), formerly Cisco
CallManager, contains a denial of service (DoS) vulnerability in the
Computer Telephony Integration (CTI) Manager service that may cause
an interruption in voice services and an authentication bypass
vulnerability in the Real-Time Information Server (RIS) Data
Collector that may expose information that is useful for
reconnaissance.
Summary
=======
Cisco Unified Communications Manager, which was formerly Cisco
Unified CallManager, contains a denial of service (DoS) vulnerability
in the Session Initiation Protocol (SIP) service. An exploit of this
vulnerability may cause an interruption in voice services.
Cisco has released free software updates that address this
vulnerability. There are no workarounds for this vulnerability.
section of the "Cisco Unified Communications Manager Administration
Guide" at:
http://www.cisco.com/en/US/docs/voice_ip_comm/cucmbe/admin/7_0_1/ccmcfg/b02ccm.html#wp1057513
Note: For a SIP port change to take effect, the Cisco CallManager
Service must be restarted. For information on how to restart the
service, refer to the "Restarting the Cisco CallManager Service"
section of the administration guide at:
http://www.cisco.com/en/US/docs/voice_ip_comm/cucmbe/admin/7_0_1/ccmcfg/b03dpi.html#wp1075124
Summary
=======
Cisco Unified Communications Manager (previously known as Cisco
CallManager) and Cisco Unified Presence Server contain an open query
interface that could allow an unauthenticated, remote attacker to
disclose the contents of the underlying databases on affected product
versions.
Cisco has released free updated software for most supported releases.
* Step 1: Log in to the Cisco Unified CM Administration web
interface.
* Step 2: Navigate to "System > Service Parameters" and select the
appropriate Cisco Unified Communications Manager server and the
Cisco CallManager service.
* Step 3: Change the SIP Interoperability Enabled parameter to
False and click "Save".
Note: For a SIP processing change to take effect, the Cisco
Step 1: Log into the Cisco Unified CM Administration web interface.
Step 2: Navigate to System > Service Parameters and select the
appropriate Cisco Unified Communications Manager server and the
"Cisco CallManager" service.
Step 3: Change the "SIP Interoperability Enabled" parameter to False,
and click Save.
Note: For a SIP processing change to take effect, the Cisco
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Cisco Unified Communications Manager Directory Traversal Vulnerability
Advisory ID: cisco-sa-20111026-cucm
Revision 1.0
For Public Release 2011 October 26 16:00 UTC (GMT)
+---------------------------------------------------------------------
Summary
=======
Cisco Unified Communications Manager, formerly Cisco CallManager,
contains a denial of service (DoS) vulnerability in the Certificate
Authority Proxy Function (CAPF) service. Exploitation of this
vulnerability could cause an interruption in voice services. The CAPF
service is disabled by default.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Cisco Security Advisory: XSS and SQL Injection in Cisco
CallManager/Unified Communications Manager Logon Page
Advisory ID: cisco-sa-20070829-ccm
http://www.cisco.com/warp/public/707/cisco-sa-20070829-ccm.shtml
Note: The September 28, 2011, Cisco IOS Software Security Advisory
bundled publication includes ten Cisco Security Advisories. Nine of the
advisories address vulnerabilities in Cisco IOS Software, and one
advisory addresses a vulnerability in Cisco Unified Communications
Manager. Each advisory lists the Cisco IOS Software releases that
correct the vulnerability or vulnerabilities detailed in the advisory as
well as the Cisco IOS Software releases that correct all vulnerabilities
in the September 2011 Bundled Publication.
Individual publication links are in "Cisco Event Response: Semiannual
Vulnerable Products
+------------------
The following Cisco products are known to be vulnerable:
* Cisco Unified Communications Manager (CUCM) 5.x and 6.x
* Cisco Unified Communications Manager Business Edition
* Cisco Unified Precense 1.x and 6.x
* Cisco Emergency Responder 2.x
* Cisco Mobility Manager 2.x
SUMMARY
=======
A SQL injection vulnerability exists in the Log On page of the web
interface for Cisco CallManager AKA Unified Communications Manager. An
unauthenticated attacker who is able to access the Log On page could
exploit this vulnerability to run arbitrary SQL commands as the logged
in database user, usually cm_publisher. By running SQL commands, the
attacker could gain information about the CallManager configuration,
including call records.
Date: 08.11.2011
________________________________________________________________________
Vendor: Cisco Systems
Product: CUCM Environment
Cisco Unified Communications Manager (CallManager)
Cisco IP Phone CP-7975G
Vulnerability: Directory Traversal
Reversible Obfuscation Algorithm
SCCP service security issues
CTFTP Information Leaks
Note: The September 22, 2010, Cisco IOS Software Security Advisory
bundled publication includes six Cisco Security Advisories. Five of
the advisories address vulnerabilities in Cisco IOS Software, and one
advisory addresses vulnerabilities in Cisco Unified Communications
Manager. Each advisory lists the releases that correct the
vulnerability or vulnerabilities detailed in the advisory. The table
at the following URL lists releases that correct all Cisco IOS
Software vulnerabilities that have been published on September 22,
2010, or earlier:
Cisco Unified Communication Manager 5.0/5.1 versions prior to 5.1(3a)
and 6.0/6.1 versions prior to 6.1(1a) are affected by this
vulnerability.
The software version of a CallManager or Unified Communications
Manager system can be determined by navigating to Show > Software via
the administration interface.
For Unified Communications Manager, the software version can also be
determined by running the show version active command in the Command
There are no workarounds that mitigate this vulnerability.
This advisory is posted at:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20111026-uccx
Cisco Unified Communications Manager is also affected by this
vulnerability and a separate advisory has been published at:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20111026-cucm
Note: Effective October 18, 2011, Cisco moved the current list of Cisco
Security Advisories and Responses published by Cisco PSIRT. The new
http://www.cisco.com/warp/public/707/cisco-sa-20080924-sip.shtml
Note: The September 24, 2008 IOS Advisory bundled publication
includes twelve Security Advisories. Eleven of the advisories address
vulnerabilities in Cisco's IOS software, and one advisory addresses
vulnerabilities in Cisco Unified Communications Manager. Each
Advisory lists the releases that correct the vulnerability described
in the Advisory. Please reference the following software table to
find a release that fixes all published IOS software Advisories as of
September 24th, 2008:
Details
=======
The Skinny Call Control Protocol (SCCP) enables voice communication
between an SCCP client and a Call Manager (CM). Typically, the CM
provides service to the SCCP clients on TCP Port 2000 by default.
Initially, an SCCP client connects to the CM by establishing a TCP
connection; the client will also establish a TCP connection with a
secondary CM, if available.
4.2.x or later (prior versions are affected)
* Cisco Prime Central
* Cisco Prime Optical
* Cisco Prime Performance Manager
* Cisco TelePresence Server
* Cisco Unified Communications Manager (formerly Cisco CallManager)
* Cisco Unity
* Cisco Unity Connection
* Cisco Wireless LAN Controllers (WLC)
This section will be updated when more information is available.
There are no available workarounds to mitigate these vulnerabilities.
This advisory is posted at:
http://www.cisco.com/warp/public/707/cisco-sa-20110824-ime.shtml
Note: Cisco Unified Communications Manager Software is also affected
by these vulnerabilities. A separate Cisco Security Advisory has been
published to disclose the vulnerabilities that affects the Cisco
Unified Communications Manager. That advisory is available at:
http://www.cisco.com/warp/public/707/cisco-sa-20110824-cucm.shtml
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Cisco Security Advisory: Cisco Unified Communications Manager Express
Vulnerability
Advisory ID: cisco-sa-20090923-cme
Revision 1.0
Next Page>>
|
