CVE-2010-4687

CVE-2010-4687 affects Cisco STCAPP (the SCCP telephony control application) on Cisco IOS before 15.0(1)XA1. The issue is that it does not properly handle multiple calls on a shared line, allowing remote attackers to cause a denial of service (port hang) by ending two calls simultaneously that are...

CVE-2009-5040

CVE-2009-5040 affects Cisco CallManager Express (CME) on Cisco IOS prior to 15.0(1)XA. The issue allows remote authenticated users to trigger a denial-of-service (device crash) by interacting with the SNR-number change menu using an Extension Mobility (EM) phone. Root cause is not detailed beyond...

CVE-2009-5040

CallManager Express CME on Cisco IOS before 15.01XA allows remote authenticated users to cause a denial of service device crash by using an extension mobility EM phone to interact with the menu for SNR number changes, aka Bug ID CSCta63555...

CVE-2010-4687

STCAPP aka the SCCP telephony control application on Cisco IOS before 15.01XA1 does not properly handle multiple calls to a shared line, which allows remote attackers to cause a denial of service port hang by simultaneously ending two calls that were controlled by CallManager Express CME, aka Bug...

CVE-2010-4686

Cisco IOS CME (CallManager Express) vulnerability CVE-2010-4686 affects CME up to version 15.0(1)XA1 and is triggered by SIP TRUNK traffic with rate bursts and a peculiar request size. The underlying cause is improper handling of such traffic, leading to memory consumption and remote denial of se...

CVE-2010-4686

CallManager Express CME on Cisco IOS before 15.01XA1 does not properly handle SIP TRUNK traffic that contains rate bursts and a "peculiar" request size, which allows remote attackers to cause a denial of service memory consumption by sending this traffic over a long duration, aka Bug ID CSCtb4795...

CVE-2010-3039

CVE-2010-3039 affects Cisco Unified Communications Manager (CUCM) 6–8. A setuid binary (/usr/local/cm/bin/pktCap_protectData) fails to validate command-line arguments, allowing a local, authenticated administrator to inject shell metacharacters and execute arbitrary commands. The vulnerability en...

CVE-2010-3039

/usr/local/cm/bin/pktCapprotectData in Cisco Unified Communications Manager aka CUCM, formerly CallManager 6, 7, and 8 allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in a request to the administrative interface, aka Bug IDs CSCti52041 and...

Vulnerability in Cisco IOS Embedded Call Processing Solutions - Cisco Systems

Cisco Internetwork Operating System IOS Software release trains 12.1YD, 12.2T, 12.3 and 12.3T, when configured for the Cisco IOS Telephony Service ITS, Cisco CallManager Express CME or Survivable Remote Site Telephony SRST may contain a vulnerability in processing certain malformed control protoc...

Code injection

The SIPStationInit implementation in Cisco Unified Communications Manager aka CUCM, formerly CallManager 6.1SU before 6.15SU1, 7.0SU before 7.02aSU3, 7.1SU before 7.13bSU2, 7.1 before 7.15, and 8.0 before 8.01 allows remote attackers to cause a denial of service process failure via a malformed SI...

CVE-2010-2837

CVE-2010-2837 affects Cisco Unified Communications Manager (CUCM) via the SIPStationInit code; a malformed SIP message can trigger a remote denial of service (process failure). Affected CUCM versions include 6.x, 7.x, and 8.x; fixes are in 6.1(5)SU1, 7.0(2a)SU3, 7.1(3b)SU2, 7.1(5), and 8.0(1). Ci...

CVE-2010-0588

Cisco Unified Communications Manager (CUCM) versions 6.x prior to 6.1(5), 7.x prior to 7.1(3a)su1, and 8.x prior to 8.0(1) are affected by a DoS vulnerability triggered by malformed SCCP messages (RegAvailableLines or FwdStatReq) containing an invalid Line number, which can cause a process failur...

CVE-2010-0591

CVE-2010-0591 affects Cisco Unified Communications Manager (CUCM) where a malformed SIP REG message can cause a DoS (process failure) due to an overflow of the Telephone-URL field. Affected CUCM versions include 6.x prior to 6.1(5), 7.x prior to 7.1(3b)SU2, and 8.x prior to 8.0(1). Cisco fixed th...

CVE-2010-0587

CVE-2010-0587 affects Cisco Unified Communications Manager (CUCM) and is triggered by a malformed SCCP StationCapabilitiesRes message with an invalid MaxCap field, leading to a DoS (process failure). The vulnerability impacts CUCM versions 4.x (before 4.3(2)SR2), 6.x (before 6.1(5)), 7.x (before ...

CVE-2010-0590

CVE-2010-0590 affects Cisco Unified Communications Manager (CUCM) CMSIPUtility. It allows remote attackers to cause a DoS (process failure) via a malformed SIP Register message on CUCM 7.x prior to 7.1(3a)su1 and 8.x prior to 8.0(1); the vulnerability is fixed in CUCM 7.1(3a)su1 and 8.0(1).

CVE-2009-2864

Cisco Unified Communications Manager (CUCM) versions affected: 5.x before 5.1(3g); 6.x before 6.1(4); 7.0.x before 7.0(2a)su1; 7.1.x before 7.1(2). Root cause is a denial-of-service in the SIP handling that can crash/restart the CM process when processing crafted SIP messages. CVSS base score in ...

Cisco Security Advisory: Cisco Unified Communications Manager Session Initiation Protocol Denial of Service Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Cisco Unified Communications Manager Session Initiation Protocol Denial of Service Vulnerability Advisory ID: cisco-sa-20090923-cm Revision 1.0 For Public Release 2009 September 23...

CVE-2009-2050

CVE-2009-2050 concerns Cisco Unified Communications Manager (CUCM, formerly CallManager). The issue allows a remote attacker to cause a denial-of-service (voice-services outage) by sending a malformed header in a SIP message (Bug CSCsi46466). Affected products are CUCM before version 6.1(1), with...

CVE-2009-2054

CVE-2009-2054 affects Cisco Unified Communications Manager (CUCM) 4.x, 5.x (before 5.1(3g)), 6.x (before 6.1(4)), 7.0 (before 7.0(2a)su1) and 7.1 (before 7.1(2a)su1). It enables remote attackers to cause a denial of service via a flood of TCP packets, leading to file-descriptor exhaustion and SIP...

CVE-2009-2053

Cisco Unified Communications Manager (CUCM) is affected by CVE-2009-2053 via a DoS vulnerability in the SCCP path: a flood of TCP packets can exhaust file descriptors and cause SCCP outages. Affected versions include CUCM 4.x, 5.x before 5.1(3g), 6.x before 6.1(4), 7.0 before 7.0(2a)su1, and 7.1 ...