Cisco CallManager contains memory leak

Overview

The Cisco Call Manager contains a vulnerability that could permit an intruder to crash the Call Manager.

Description

The Cisco Call Manageris software to manage telephone calls in a mixed data and voice environment. Specifically the Cisco Call Manager “extends enterprise telephony features and functions to packet telephony network devices such as IP phones, media processing devices, voice-over-IP (VoIP) gateways, and multimedia applications.1” The software contains a vulnerability that allows could permit an intruder to consume memory until the system crashes. Quoting from Cisco’s Security Advisory:

The Cisco CallManager, running certain software releases, has a vulnerability wherein a memory leak in the CTI Framework authentication can cause the server to crash and result in a reload. This vulnerability can be exploited to initiate a denial of service (DoS) attack.

It may be possible for the vulnerability to be triggered accidentally. For more information, see the vendor statement from Cisco below.

---

Impact

An intruder could interrupt the normal function of the Cisco Call Manager, causing it to crash and reload.

---

Solution

Upgrade to a more recent version of Cisco Call Manager, as described in <http://www.cisco.com/warp/public/707/callmanager-ctifw-leak-pub.shtml&gt;.

---

Vendor Information

495275

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Cisco Systems Inc. __ Affected

Updated: August 09, 2002

Status

Affected

Vendor Statement

-----BEGIN PGP SIGNED MESSAGE-----

UPDATED: Cisco Security Advisory: LDAP Connection Leak in CTI when User Authentication Fails
The Cisco Security Advisory regarding a memory leak in LDAP connections when CTI user authentication fails has been updated with new information. Cisco is reissuing this advisory because the affected software versions and first fixed releases information was listed incorrectly in previous versions of the advisory. Cisco CallManager version 3.0 is affected and the first fixed release is Cisco CallManager version 3.1(3a). Customers running 3.1(3a) or later are still unaffected.

- -------------------------------------------------------------------------
Cisco Security Advisory: LDAP Connection Leak in CTI when User Authentication Fails
Revision 1.2
For Public Release 2002 March 27 17:00 GMT
Last Updated 2002 March 29 18:00 GMT
- -------------------------------------------------------------------------------
Contents
Summary Affected Products Details Impact Software Versions and Fixes Obtaining Fixed Software Workarounds Exploitation and Public Announcements Status of This Notice Distribution Revision History Cisco Security Procedures
- -------------------------------------------------------------------------------
Summary
The Cisco CallManager, running certain software releases, has a vulnerability wherein a memory leak in the CTI Framework authentication can cause the server to crash and result in a reload. This vulnerability can be exploited to initiate a denial of service (DoS) attack.
This vulnerability is documented as Cisco bug ID CSCdv28302. There are workarounds available to mitigate the vulnerability.
This advisory is available at ``<http://www.cisco.com/warp/public/707/callmanager-ctifw-leak-pub.shtml>``.
Affected Products
To determine if a product is vulnerable, review the list below. If the software versions or configuration information are provided, then only those combinations are vulnerable.
* Cisco CallManager 3.0, 3.1
No other Cisco product is known to be affected by this vulnerability.
Details
A memory leak in the Cisco CallManager has been attributed to the failure of a user to properly authenticate when using Computer Telephony Integration (CTI). This behavior is most commonly seen on CallManager systems immediately following the integration with a customer directory such as Active Directory (AD) or Netscape. The most common cause in this scenario is that the WebAttendant user, CTI Framework (CTIFW), has not been configured with a valid password in the customer directory. Please note that this problem will occur even on systems that do not utilize the WebAttendant since the Telephony Call Dispatch (TCD) service is always enabled by default. The CCMAdmin->Global Directory and "Add a New User" configuration pages stop working if CTIFW user is not configured or the CTI user's password is incorrect. Various other components such as RIS Data Collector may also fail to function properly.
Bug ID This vulnerability is documented as Cisco Bug ID CSCdv28302.
Problem Symptoms
There are several indicators available in determining if this problem is at the root.
LDAP Leak Detection +-----------------------------------------------------+ | Tool | Message | |-------+---------------------------------------------| | |Error: kCtiProviderOpenFailure - CTI | | |application failed to open provider | | |CTIconnectionId: 485 | | |Login User Id: CtiFw | | |ReasonCode: 2362179680 | | |IPAddress: 172.21.12.44 | | |App ID: Cisco CTIManager | | |Cluster ID: JMTAO-CM2-Cluster | |Event |Node ID: JMTAO-CM2 | |Viewer |CTI Application ID: Cisco Telephony Call | | |Dispatcher | | |Process ID: 0 | | |Process Name: CtiHandler | | |Provider Name: CTI Framework | | |Explanation: Application is unable to open | | |provider. | | |Recommended Action: Check the reason code and| | |correct the problem. Restart | | |CTIManager if problem persists.. | |-------+---------------------------------------------| | |From the Task Manager select the Processes | | |tab, click View and then Select Columns... | |Task |Check Handle Count and click OK. | |Manager|Click on the Handles column to sort by | | |handles used. | | |You will observe that the CTIManager.exe is | | |consuming a large number of handles (> 500). | |-------+---------------------------------------------| | |Another diagnostic tool is to run "netstat | | |-na" from a DOS command prompt on the CM | |DOS |server. A very large number of established | |netstat|connections to TCP port 389 if CallManager is| | |integrated with AD or port 8404 when | | |CallManager is integrated with DCD. | +-----------------------------------------------------+
Impact
The vulnerabilities can be exploited to produce a Denial of Service (DoS) attack. When the vulnerabilities are exploited, they can cause an affected Cisco product to crash and reload.
Software Versions and Fixes
+-----------------------------------------------------+ |Version |Fixed Regular Release (available now) | |Affected |Fix carries forward into all later | | |versions | |--------------+--------------------------------------| |Version 3.0 |Upgrade to 3.1(3a) | |--------------+--------------------------------------| |Version 3.1 |Upgrade to 3.1(3a) | +-----------------------------------------------------+
Obtaining Fixed Software
Cisco is offering free software upgrades to address this vulnerability for all affected customers. Customers may only install and expect support for the feature sets they have purchased.
Customers with service contracts should contact their regular update channels to obtain any software release containing the feature sets they have purchased. For most customers with service contracts, this means that upgrades should be obtained through the Software Center on Cisco's Worldwide Web site at ``<http://www.cisco.com>``.
Customers whose Cisco products are provided or maintained through a prior or existing agreement with third-party support organizations such as Cisco Partners, authorized resellers, or service providers should contact that support organization for assistance with obtaining the free software upgrade (s).
Customers who purchased directly from Cisco but who do not hold a Cisco service contract, and customers who purchase through third party vendors but are unsuccessful at obtaining fixed software through their point of sale, should obtain fixed software by contacting the Cisco Technical Assistance Center (TAC) using the contact information listed below. In these cases, customers are entitled to obtain an upgrade to a later version of the same release or as indicated by the applicable row in the Software Versions and Fixes table (noted above).
Cisco TAC contacts are as follows:
` * +1 800 553 2447 (toll free from within North America)

• +1 408 526 7209 (toll call from anywhere in the world)
• e-mail: [email protected]
  See <http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml> for additional
  TAC contact information, including special localized telephone numbers and
  instructions and e-mail addresses for use in various languages.
  Please have your product serial number available and give the URL of this
  notice as evidence of your entitlement to a free upgrade.
  Please do not contact either “[email protected]” or “[email protected]”
  for software upgrades.
  Workarounds
  Configure the ctifw user by following the instructions at:
  <http://www.cisco.com/univercd/cc/td/doc/product/voice/c_callmg/3_0/install/ad_3011.htm#xtocid30717>
  ±----------------------------------------------------+
  |Step| Action |
  |----±-----------------------------------------------|
  | |Set the password for the user in the corporate |
  |1 |directory using your standard user management |
  | |tools. |
  |----±-----------------------------------------------|
  | |On a Cisco CallManager server, choose Start > |
  |2 |Run and enter command to open a command prompt. |
  | |Click OK. |
  |----±-----------------------------------------------|
  |3 |Enter the command, PasswordUtils; for example, |
  | |“passwordUtils my_passphrase” |
  |----±-----------------------------------------------|
  | |The previous action generates an encrypted |
  |4 |password. Copy the password into the Windows |
  | |clipboard. |
  |----±-----------------------------------------------|
  |5 |Choose Start > Run. |
  |----±-----------------------------------------------|
  |6 |Enter regedit into the Open field and then click|
  | |OK. |
  |----±-----------------------------------------------|
  | |Browse to \HKEY_LOCAL_MACHINE\Software\Cisco |
  |7 |Systems, Inc.\Directory Configuration within the|
  | |registry. |
  |----±-----------------------------------------------|
  |8 |Delete the value CTIFWPW and paste the encrypted|
  | |password from Step 3 into the field. |
  |----±-----------------------------------------------|
  | |Restart the Cisco Telephony Call Dispatcher |
  | |service by choosing Start > Programs > |
  |9 |Administrative Tools > Services. Highlight the |
  | |service in the list; right click on the service |
  | |and then click Restart from the drop-down list. |
  |----±-----------------------------------------------|
  |10 |Repeat Step 2 through Step 9 for each Cisco |
  | |CallManager server in the cluster. |
  ±----------------------------------------------------+
  IMPORTANT: Please note that you must reboot the CM server in all cases to reset
  the established TCP connections and recover the lost memory.
  Alternatively, if you are not using the Cisco WebAttendant and/or the Cisco
  Telephony Call Dispatcher Service, set it to “manual” or “disabled” from the
  “Services” control panel.
  Exploitation and Public Announcements
  The Cisco PSIRT is not aware of any public announcements or malicious use of
  the vulnerabilities described in this advisory.
  Status of This Notice: Interim
  This is a Interim advisory. Although Cisco cannot guarantee the accuracy of all
  statements in this notice, all of the facts have been checked to the best of
  our ability. Cisco does not anticipate issuing updated versions of this
  advisory unless there is some material change in the facts. Should here be a
  significant change in the facts, Cisco may update this advisory.
  Distribution
  This notice will be posted on Cisco’s Worldwide Web site at
  <http://www.cisco.com/warp/public/707/callmanager-ctifw-leak-pub.shtml>.
  In addition to Worldwide Web posting, a text version of this notice is
  clear-signed with the Cisco PSIRT PGP key and is posted to the following
  e-mail and Usenet news recipients:
  * [email protected]
• [email protected]
• [email protected] (includes CERT/CC)
• [email protected]
• comp.dcom.sys.cisco
• [email protected]
• Various internal Cisco mailing lists
  Future updates of this notice, if any, will be placed on Cisco’s Worldwide Web
  server, but may or may not be actively announced on mailing lists or
  newsgroups. Users concerned about this problem are encouraged to check the URL
  given above for any updates.
  Revision History
  ±----------------------------------------------------+
  |Revision |2002-Mar-27 17: |Initial Public Release |
  |Number 1.0 |00 GMT | |
  |------------±---------------±----------------------|
  |Revision |2002-Mar-28 17: |Corrected first fixed |
  |Number 1.1 |00 GMT |release. |
  |------------±---------------±----------------------|
  |Revision |2002-Mar-29 18: |Updated affected |
  |Number 1.2 |00 GMT |products and fixed |
  | | |releases. |
  ±----------------------------------------------------+
  Cisco Security Procedures
  Complete information on reporting security vulnerabilities in Cisco products,
  obtaining assistance with security incidents, and registering to receive
  security information from Cisco, is available on Cisco’s Worldwide Web site at
  <http://www.cisco.com/warp/public/707/sec_incident_response.shtml>. This includes
  instructions for press inquiries regarding Cisco security notices. All Cisco
  Security Advisories are available at <http://www.cisco.com/go/psirt>.
  - -------------------------------------------------------------------------------
  This notice is Copyright 2002 by Cisco Systems, Inc. This notice may be
  redistributed freely after the release date given at the top of the text,
  provided that redistributed copies are complete and unmodified, and include all
  date and version information.
  - -------------------------------------------------------------------------------
  `

-----BEGIN PGP SIGNATURE----- Version: PGP 6.5.2
iQEVAwUBPKTTDw/VLJ+budTTAQFKwAf/e0YPKtvZPXVCTK7uyLAPfs8uUWVXB+6l yXpTVVW1Uvjm9jW0l8Ko8Q8MzV0IMxp4gFG0W4rZag8JkZX+ocvq8TL2oussxFZa vE+5mezZoLH6ZWcNBfgdtAt7mIbUxh5dzePaLqRdj95VzBVne2c3GPAeTlNJdZNu rSMKbDPE/JKvCrTvMxoKfX4r4i9ttSrrSjdKeTAOVZSM/PQlbb1kaqYVcf1Se/78 RVKuLhr7es3vZCeYjknMS7lKvZDya5QoDkaIl0KXwXeDQVa7kCVpGYhyow/HTNNG XQ6vdkUkVANKxWCUbb6R5frvCs18AKAjHxDtgPWAPdEs3VarWqhaGg== =6WaS -----END PGP SIGNATURE-----

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23495275 Feedback>).

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://www.cisco.com/warp/public/707/callmanager-ctifw-leak-pub.shtml&gt;
• <http://www.cisco.com/warp/public/cc/pd/nemnsw/callmn/index.shtml&gt;
• <http://www.cisco.com/warp/public/180/prod_plat/cust_cont/icm/cti.html&gt;
• <http://www.securityfocus.com/bid/4370&gt;

Acknowledgements

Thanks to Cisco Systems Product Security Incident Response Team for reporting this vulnerability.

This document was written by Shawn V Hernan, based on information provided by Cisco Systems.

Other Information

CVE IDs:	CVE-2002-0505
Severity Metric:	5.63 Date Public: