Multiple Product Vulnerabilities Found by PROTOS SIP Test Suite - Cisco Systems

Multiple Cisco products contain vulnerabilities in the processing of Session Initiation Protocol SIP INVITE messages. These vulnerabilities were identified by the University of Oulu Secure Programming Group OUSPG "PROTOS" Test Suite for SIP and can be repeatedly exploited to produce a denial of...

Multiple Cisco IOS Session Initiation Protocol Denial of Service Vulnerabilities

Multiple vulnerabilities exist in the Session Initiation Protocol SIP implementation in Cisco IOS that can be exploited remotely to trigger a memory leak or to cause a reload of the IOS device. Cisco has released free software updates that address these vulnerabilities. Fixed Cisco IOS software...

Cisco Security Advisory: Cisco Unified Communications Manager Denial of Service Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Cisco Unified Communications Manager Denial of Service Vulnerabilities Advisory ID: cisco-sa-20100825-cucm Revision 1.0 For Public Release 2010 August 25 1600 UTC GMT...

Cisco Security Advisory: Cisco Unified Presence Denial of Service Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Cisco Unified Presence Denial of Service Vulnerabilities Advisory ID: cisco-sa-20100825-cup Revision 1.0 For Public Release 2010 August 25 1600 UTC GMT +---------------------------------------------------------------------...

CVE-2010-2838

The SendCombinedStatusInfo implementation in Cisco Unified Communications Manager aka CUCM, formerly CallManager 7.0SU before 7.02aSU3, 7.1 before 7.15, and 8.0 before 8.03 allows remote attackers to cause a denial of service process failure via a malformed SIP REGISTER message, aka Bug ID...

CVE-2010-2837

The SIPStationInit implementation in Cisco Unified Communications Manager aka CUCM, formerly CallManager 6.1SU before 6.15SU1, 7.0SU before 7.02aSU3, 7.1SU before 7.13bSU2, 7.1 before 7.15, and 8.0 before 8.01 allows remote attackers to cause a denial of service process failure via a malformed SI...

Code injection

The SIPStationInit implementation in Cisco Unified Communications Manager aka CUCM, formerly CallManager 6.1SU before 6.15SU1, 7.0SU before 7.02aSU3, 7.1SU before 7.13bSU2, 7.1 before 7.15, and 8.0 before 8.01 allows remote attackers to cause a denial of service process failure via a malformed SI...

Command injection

The SendCombinedStatusInfo implementation in Cisco Unified Communications Manager aka CUCM, formerly CallManager 7.0SU before 7.02aSU3, 7.1 before 7.15, and 8.0 before 8.03 allows remote attackers to cause a denial of service process failure via a malformed SIP REGISTER message, aka Bug ID...

Code injection

The Presence Engine PE service in Cisco Unified Presence 6.x before 6.07 and 7.x before 7.08 does not properly handle an erroneous Contact field in the header of a SIP SUBSCRIBE message, which allows remote attackers to cause a denial of service process failure via a malformed message, aka Bug ID...

CVE-2010-2840

The Presence Engine PE service in Cisco Unified Presence 6.x before 6.07 and 7.x before 7.08 does not properly handle an erroneous Contact field in the header of a SIP SUBSCRIBE message, which allows remote attackers to cause a denial of service process failure via a malformed message, aka Bug ID...

CVE-2010-2840

Cisco CVE-2010-2840 affects the Presence Engine (PE) service in Cisco Unified Presence 6.x before 6.0(7) and 7.x before 7.0(8). A malformed SIP SUBSCRIBE header with an erroneous Contact field can cause a DoS (process failure). The issue is resolved in 6.0(7) and 7.0(8) by official fixes; no expl...

CVE-2010-2839

SIPD in Cisco Unified Presence 6.x before 6.07 and 7.x before 7.08 allows remote attackers to cause a denial of service stack memory corruption and process failure via a malformed SIP message, aka Bug ID CSCtd14474...

CVE-2010-2837

The SIPStationInit implementation in Cisco Unified Communications Manager aka CUCM, formerly CallManager 6.1SU before 6.15SU1, 7.0SU before 7.02aSU3, 7.1SU before 7.13bSU2, 7.1 before 7.15, and 8.0 before 8.01 allows remote attackers to cause a denial of service process failure via a malformed SI...

CVE-2010-2837

CVE-2010-2837 affects Cisco Unified Communications Manager (CUCM) via the SIPStationInit code; a malformed SIP message can trigger a remote denial of service (process failure). Affected CUCM versions include 6.x, 7.x, and 8.x; fixes are in 6.1(5)SU1, 7.0(2a)SU3, 7.1(3b)SU2, 7.1(5), and 8.0(1). Ci...

CVE-2010-2838

CVE-2010-2838 affects Cisco Unified Communications Manager (CUCM). The vulnerability is caused by the SendCombinedStatusInfo implementation in CUCM’s SIP handling, where a malformed SIP REGISTER message can trigger a denial of service (process failure). Affected CUCM versions are 7.0(2a)SU3, 7.1(...

Cisco Releases Advisories for Unified Communications Manager and Unified Presence

Cisco has released security advisories to address multiple vulnerabilities affecting Unified Communications Manager and Unified Presence. These vulnerabilities affect the processing of Session Initiation Protocol SIP messages. Exploitation of these vulnerabilities may allow an attacker to cause a...

CVE-2010-2825

Unspecified vulnerability in the SIP inspection feature on the Cisco Application Control Engine ACE Module with software A21.x before A21.6, A22.x before A22.3, and A23.x before A23.1 for Catalyst 6500 series switches and 7600 series routers, and the Cisco Application Control Engine ACE 4710...

Information disclosure

Unspecified vulnerability in the SIP inspection feature on the Cisco Application Control Engine ACE Module with software A21.x before A21.6, A22.x before A22.3, and A23.x before A23.1 for Catalyst 6500 series switches and 7600 series routers, and the Cisco Application Control Engine ACE 4710...

Zoiper < 2.24 SIP INVITE Request Remote DoS

Binary data 5630.prm...

CVE-2010-2825

Unspecified vulnerability in the SIP inspection feature on the Cisco Application Control Engine ACE Module with software A21.x before A21.6, A22.x before A22.3, and A23.x before A23.1 for Catalyst 6500 series switches and 7600 series routers, and the Cisco Application Control Engine ACE 4710...