Multiple Cisco Unified CallManager and Presence Server Denial of Service Vulnerabilities

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES TH...

[Full-disclosure] Cisco Security Advisory: Multiple Cisco Unified CallManager and Presence Server Denial of Service Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Multiple Cisco Unified CallManager and Presence Server Denial of Service Vulnerabilities Advisory ID: cisco-sa-20070328-voip http://www.cisco.com/warp/public/707/cisco-sa-20070328-voip.shtml Revision 1.0 For Public Release 200...

Cisco Unified CallManager / Unified Presence Server multiple security vulnerabilities

Denial of service with Skinny / SCCP protocol TCP/2000, TCP/2443, ICMP echo requiests flood, IPSec UDP/8500 parsing...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in 1 PreSearch.html and 2 PreSearch.class in Cisco Secure Access Control Server ACS, VPN Client, Unified Personal Communicator, MeetingPlace, Unified MeetingPlace, Unified MeetingPlace Express, CallManager, IP Communicator, Unified Video Advantage...

CVE-2007-1467

The CVE-2007-1467 entry describes multiple cross-site scripting (XSS) vulnerabilities affecting Cisco Secure Access Control Server and related Cisco products. The root issue is insufficient input filtering in the search form used by PreSearch.html and PreSearch.class, allowing remote attackers to...

CVE-2006-5553

Cisco Security Agent CSA for Linux 4.5 before 4.5.1.657 and 5.0 before 5.0.0.193, as used by Unified CallManager CUCM and Unified Presence Server CUPS, allows remote attackers to cause a denial of service resource consumption via a port scan with certain options...

CVE-2006-5553

Cisco Security Agent CSA for Linux 4.5 before 4.5.1.657 and 5.0 before 5.0.0.193, as used by Unified CallManager CUCM and Unified Presence Server CUPS, allows remote attackers to cause a denial of service resource consumption via a port scan with certain options...

Skinny Server Detection

The remote server is an H.323 proxy that understands the Skinny protocol, also known as SCCP, for 'Skinny Client Control Protocol'. Skinny is Cisco's proprietary lightweight terminal control protocol used by some VoIP phones to communicate with Cisco CallManager or Asterisk PBX systems. C Tenable...

CVE-2006-4032

Unspecified vulnerability in Cisco IOS CallManager Express CME allows remote attackers to gain sensitive information user names from the Session Initiation Protocol SIP user directory via certain SIP messages, aka bug CSCse92417...

CVE-2006-4032

Unspecified vulnerability in Cisco IOS CallManager Express CME allows remote attackers to gain sensitive information user names from the Session Initiation Protocol SIP user directory via certain SIP messages, aka bug CSCse92417...

CVE-2006-3592

Unspecified vulnerability in the command line interface CLI in Cisco Unified CallManager CUCM 5.01 through 5.03a allows local users to execute arbitrary commands with elevated privileges via unspecified vectors, involving "certain CLI commands," aka bug CSCse11005...

CVE-2006-3594

Buffer overflow in Cisco Unified CallManager CUCM 5.01 through 5.03a allows remote attackers to execute arbitrary code via a long hostname in a SIP request, aka bug CSCsd96542...

CVE-2006-3593

The command line interface CLI in Cisco Unified CallManager CUCM 5.01 through 5.03a allows local users to overwrite arbitrary files by redirecting a command's output to a file or folder, aka bug CSCse31704...

Update Protection against Cisco CallManager Cross Site Scripting Vulnerabilities

Cisco Unified CallManager software is the call-processing component of the Cisco Unified Communications system. The web interface used to administer Cisco CallManager software fails to properly validate user input. A specially crafted request could cause the CallManager web interface to include...

CVE-2006-3593

The command line interface CLI in Cisco Unified CallManager CUCM 5.01 through 5.03a allows local users to overwrite arbitrary files by redirecting a command's output to a file or folder, aka bug CSCse31704...

CVE-2006-3594

Buffer overflow in Cisco Unified CallManager CUCM 5.01 through 5.03a allows remote attackers to execute arbitrary code via a long hostname in a SIP request, aka bug CSCsd96542...

CVE-2006-3593

CVE-2006-3593 affects Cisco Unified CallManager (CUCM) in versions 5.0(1) through 5.0(3a). The vulnerability enables local users to overwrite arbitrary files by redirecting a command’s output to a file or folder, described as bug CSCse31704. The connected documents confirm the affected product an...

CVE-2006-3594

CVE-2006-3594 refers to a buffer overflow in Cisco Unified CallManager (CUCM) 5.0(1)–5.0(3a) that lets remote attackers execute arbitrary code via a long hostname in a SIP request (bug CSCsd96542). The issue affects CUCM and is ranked HIGH with CVSS v2 base score 7.5, vector AV:N/AC:L/Au:N/C:P/I:...

CVE-2006-3592

Cisco Unified CallManager (CUCM) 5.0(1)–5.0(3a) contains an unspecified CLI vulnerability (bug CSCse11005) that allows local users to execute arbitrary commands with elevated privileges via certain CLI commands. Affected component: CLI in CUCM. Root cause: unspecified vectors within the CLI comma...

CVE-2006-3592

Unspecified vulnerability in the command line interface CLI in Cisco Unified CallManager CUCM 5.01 through 5.03a allows local users to execute arbitrary commands with elevated privileges via unspecified vectors, involving "certain CLI commands," aka bug CSCse11005...