Cisco Unified Communications Manager Web Applications Identity Management Subsystem Denial of Service Vulnerability

A vulnerability in the Identity Management subsystem used by the WebApplications of Cisco Unified Communications Manager (Cisco UCM) software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition.

The vulnerability is due to invalid session requests. An attacker could exploit this vulnerability by sending invalid session tokens to the subsystem of an affected system. A successful exploit could allow the attacker to cause a DoS condition for a specific application. The affected subsystem would need to be restarted.

Cisco has released software updates that address this vulnerability. Workarounds that mitigate this vulnerability are not available.

This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151215-ucmim[“https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151215-ucmim”]