CVE-2010-2835

CVE-2010-2835 affects Cisco IOS Software (12.2–12.4, 15.0–15.1), Cisco IOS-XE 2.5.x/2.6.x before 2.6.1, and CUCM 6.x/7.x/8.x. The flaw resides in SIP processing where a crafted SIP REFER with an invalid Refer-To header can trigger a DoS, causing device reloads or voice-services outages. Fixed ver...

Cisco Releases Security Advisories

Cisco has released six security advisories to address vulnerabilities affecting the Cisco IOS Software and the Cisco Unified Communications Manager. Exploitation of these vulnerabilities may allow an attacker to cause a denial-of-service condition. US-CERT encourages users and administrators to...

Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerabilities

Multiple vulnerabilities exist in the Session Initiation Protocol SIP implementation in Cisco IOS® Software that could allow an unauthenticated, remote attacker to cause a reload of an affected device when SIP operation is enabled. Cisco has released software updates that address these...

Microsoft IIS Repeated Parameter Request Denial of Service Vulnerability

Description Microsoft IIS is prone to a remote denial-of-service vulnerability. An attacker can exploit this issue to force the affected application to become unresponsive, denying service to legitimate users. This issue affects IIS 5.1, 6.0, 7.0, and 7.5. Technologies Affected Avaya Aura...

Microsoft Windows CSRSS Memory Allocation Local Privilege Escalation Vulnerability

Description Microsoft Windows is prone to a local privilege-escalation vulnerability. An attacker can exploit this issue to execute arbitrary code with SYSTEM-level privileges. Successfully exploiting this issue will result in the complete compromise of affected computers. This issue affects...

Microsoft Windows and Office Uniscribe Font Parsing Engine Remote Code Execution Vulnerability

Description Microsoft Windows and Office are prone to a remote code-execution vulnerability when handling crafted font data. An attacker can exploit this issue by enticing an unsuspecting user to open a malicious file or webpage. A successful exploit may allow arbitrary code to run in the context...

Cisco Unified Communications Manager Express Denial of Service Vulnerabilities (cisco-sa-20100324-cucme)

Devices running Cisco IOS Software and configured for Cisco Unified Communications Manager Express CME or Cisco Unified Survivable Remote Site Telephony SRST operation are affected by two denial of service vulnerabilities that may result in a device reload if successfully exploited. The...

Voice Vulnerabilities in Cisco IOS and Cisco Unified Communications Manager - Cisco Systems

Multiple voice-related vulnerabilities are identified in Cisco IOS software, one of which is also shared with Cisco Unified Communications Manager. These vulnerabilities pertain to the following protocols or features: - Session Initiation Protocol SIP - Media Gateway Control Protocol MGCP -...

Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerability (cisco-sa-20090923-sip)

A vulnerability exists in the Session Initiation Protocol SIP implementation in Cisco IOS Software that could allow an unauthenticated attacker to cause a denial of service DoS condition on an affected device when the Cisco Unified Border Element feature is enabled. Cisco has released free softwa...

Cisco Unified Communications Manager Express Vulnerability - Cisco Systems

Cisco IOS devices that are configured for Cisco Unified Communications Manager Express CME and the Extension Mobility feature are affected by a buffer overflow vulnerability. Successful exploitation of this vulnerability may result in the execution of arbitrary code or a denial of service DoS...

Focus on Secrecy Could Hamper Pentagon's Cybersecurity Plans

The former head of the Department of Homeland Security’s Cyber Security Division warns that the U.S. military’s preoccupation with secrecy could hamper efforts to get the upper hand in cyber security. An article last week by the U.S Deputy Secretary of Defense put the U.S. military’s cybersecurit...

Cisco Security Advisory: Cisco Unified Presence Denial of Service Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Cisco Unified Presence Denial of Service Vulnerabilities Advisory ID: cisco-sa-20100825-cup Revision 1.0 For Public Release 2010 August 25 1600 UTC GMT +---------------------------------------------------------------------...

CVE-2010-2839

SIPD in Cisco Unified Presence 6.x before 6.07 and 7.x before 7.08 allows remote attackers to cause a denial of service stack memory corruption and process failure via a malformed SIP message, aka Bug ID CSCtd14474...

CVE-2010-2840

The Presence Engine PE service in Cisco Unified Presence 6.x before 6.07 and 7.x before 7.08 does not properly handle an erroneous Contact field in the header of a SIP SUBSCRIBE message, which allows remote attackers to cause a denial of service process failure via a malformed message, aka Bug ID...

CVE-2010-2838

The SendCombinedStatusInfo implementation in Cisco Unified Communications Manager aka CUCM, formerly CallManager 7.0SU before 7.02aSU3, 7.1 before 7.15, and 8.0 before 8.03 allows remote attackers to cause a denial of service process failure via a malformed SIP REGISTER message, aka Bug ID...

Memory corruption

SIPD in Cisco Unified Presence 6.x before 6.07 and 7.x before 7.08 allows remote attackers to cause a denial of service stack memory corruption and process failure via a malformed SIP message, aka Bug ID CSCtd14474...

Code injection

The Presence Engine PE service in Cisco Unified Presence 6.x before 6.07 and 7.x before 7.08 does not properly handle an erroneous Contact field in the header of a SIP SUBSCRIBE message, which allows remote attackers to cause a denial of service process failure via a malformed message, aka Bug ID...

Command injection

The SendCombinedStatusInfo implementation in Cisco Unified Communications Manager aka CUCM, formerly CallManager 7.0SU before 7.02aSU3, 7.1 before 7.15, and 8.0 before 8.03 allows remote attackers to cause a denial of service process failure via a malformed SIP REGISTER message, aka Bug ID...

Code injection

The SIPStationInit implementation in Cisco Unified Communications Manager aka CUCM, formerly CallManager 6.1SU before 6.15SU1, 7.0SU before 7.02aSU3, 7.1SU before 7.13bSU2, 7.1 before 7.15, and 8.0 before 8.01 allows remote attackers to cause a denial of service process failure via a malformed SI...

CVE-2010-2840

Cisco CVE-2010-2840 affects the Presence Engine (PE) service in Cisco Unified Presence 6.x before 6.0(7) and 7.x before 7.0(8). A malformed SIP SUBSCRIBE header with an erroneous Contact field can cause a DoS (process failure). The issue is resolved in 6.0(7) and 7.0(8) by official fixes; no expl...