CVE-2008-1745: Improper Input Validation

Cisco Unified Communications Manager CUCM 5.x before 5.12 and 6.x before 6.11 allows remote attackers to cause a denial of service service interruption via a SIP JOIN message with a malformed header, aka Bug ID CSCsi48115...

CVE-2008-1746: Improper Input Validation

The SNMP Trap Agent service in Cisco Unified Communications Manager CUCM 4.1 before 4.13SR6, 4.2 before 4.23SR3, 4.3 before 4.32, 5.x before 5.13, and 6.x before 6.11 allows remote attackers to cause a denial of service core dump and service restart via a series of malformed UDP packets, as...

CVE-2008-1747: Improper Input Validation

Unspecified vulnerability in Cisco Unified Communications Manager 4.1 before 4.13SR6, 4.2 before 4.23SR3, 4.3 before 4.32, 5.x before 5.13, and 6.x before 6.11 allows remote attackers to cause a denial of service CCM service restart via an unspecified SIP INVITE message, aka Bug ID CSCsk46944...

CVE-2008-1741: Improper Input Validation

The SIP Proxy SIPD service in Cisco Unified Presence before 6.03 allows remote attackers to cause a denial of service core dump and service interruption via a TCP port scan, aka Bug ID CSCsj64533...

CVE-2008-1158: Improper Input Validation

The Presence Engine PE service in Cisco Unified Presence before 6.01 allows remote attackers to cause a denial of service core dump and service interruption via malformed packets, aka Bug ID CSCsh50164...

CVE-2008-1742: Undefined Security Weakness

Memory leak in the Certificate Trust List CTL Provider service in Cisco Unified Communications Manager CUCM 5.x before 5.13 allows remote attackers to cause a denial of service memory consumption and service interruption via a series of malformed TCP packets, as demonstrated by TCPFUZZ, aka Bug I...

Cisco Security Advisory: Cisco Unified Presence Denial of Service Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Cisco Unified Presence Denial of Service Vulnerabilities Advisory ID: cisco-sa-20080514-cup Revision 1.0 +--------------------------------------------------------------------- Summary ======= Cisco Unified Presence contains...

Cisco Unified Presence Denial of Service

Presence Engine service DoS, SIP proxy DoS...

Cisco Unified Presence Denial of Service Vulnerabilities

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES TH...

Cisco Unified Communications Manager Denial of Service Vulnerabilities

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES TH...

Cisco Unified Communications灾难恢复框架远程命令执行漏洞

BUGTRAQ ID: 28591 CVECAN ID: CVE-2008-1154 灾难恢复框架（DRF）是Cisco Unified Communications产品家族中一些产品间所共享的功能，允许管理员将系统配置备份和恢复到本地磁带驱动或远程服务器。 DRF Master服务器负责执行备份和恢复请求。DRF Master服务器对从网络接收到的请求没有执行认证，未经认证的远程用户可以连接到DRF Master服务器并执行任何DRF相关的任务，包括： 修改或删除计划备份 将系统备份拷贝到用户指定的远程服务器 从远程服务器恢复用户指定的配置 执行任意操作系统命令...

Cisco Unified Communications Disaster Recovery Framework code execution

Command execution thorugh backup management service...

Cisco Security Advisory: Cisco Unified Communications Disaster Recovery Framework Command Execution Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Cisco Unified Communications Disaster Recovery Framework Command Execution Vulnerability Advisory ID: cisco-sa-20080403-drf http://www.cisco.com/warp/public/707/cisco-sa-20080403-drf.shtml Revision 1.0 For Public Release 2008...

Authentication flaw

The Disaster Recovery Framework DRF master server in Cisco Unified Communications products, including Unified Communications Manager CUCM 5.x and 6.x, Unified Presence 1.x and 6.x, Emergency Responder 2.x, and Mobility Manager 2.x, does not require authentication for requests received from the...

CVE-2008-1154

The Disaster Recovery Framework DRF master server in Cisco Unified Communications products, including Unified Communications Manager CUCM 5.x and 6.x, Unified Presence 1.x and 6.x, Emergency Responder 2.x, and Mobility Manager 2.x, does not require authentication for requests received from the...

CVE-2008-1154

The CVE-2008-1154 issue affects Cisco Unified Communications products featuring Disaster Recovery Framework (DRF). The DRF Master server accepts network requests without authentication, allowing a remote, unauthenticated attacker to perform DRF tasks and, per the sources, potentially execute arbi...

CVE-2008-1154: Improper Authentication

The Disaster Recovery Framework DRF master server in Cisco Unified Communications products, including Unified Communications Manager CUCM 5.x and 6.x, Unified Presence 1.x and 6.x, Emergency Responder 2.x, and Mobility Manager 2.x, does not require authentication for requests received from the...

Cisco Unified Communications Disaster Recovery Framework Command Execution Vulnerability

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES TH...

CVE-2008-1113: Exposure of Sensitive Information to an Unauthorized Actor

Cisco Unified Wireless IP Phone 7921, when using Protected Extensible Authentication Protocol PEAP, does not validate server certificates, which allows remote wireless access points to steal hashed passwords and conduct man-in-the-middle MITM attacks...

Cisco Unified Communications Manager key参数SQL注入漏洞

BUGTRAQ ID: 27775 CVECAN ID: CVE-2008-0026 Cisco Unified Communications Manager（CUCM，之前被称为CallManager）是Cisco IP电话解决方案中的呼叫处理组件。 CUCM的管理员和用户界面页面的key参数存在SQL注入漏洞，远程攻击者可能利用此漏洞获取敏感信息。 攻击者可以在管理员或用户界面页面的key参数中输入特制值触发SQL注入漏洞，可通过Web界面使用http或https协议来执行攻击，成功攻击可以终止SQL调用，强制到后端数据库的连接，导致泄露敏感信息，如用户名和口令哈希。 Cisco...