Voice Vulnerabilities in Cisco IOS and Cisco Unified Communications Manager - Cisco Systems

Multiple voice-related vulnerabilities are identified in Cisco IOS software, one of which is also shared with Cisco Unified Communications Manager. These vulnerabilities pertain to the following protocols or features: - Session Initiation Protocol SIP - Media Gateway Control Protocol MGCP -...

SIP Packets Reload IOS Devices with support for SIP

Cisco devices running an affected version of Internetwork Operating System IOS which supports Session Initiation Protocol SIP are affected by a vulnerability that may lead to a reload of the device when receiving a specific series of packets destined to port 5060. This issue is compounded by a...

Multiple Cisco IOS Session Initiation Protocol Denial of Service Vulnerabilities

Multiple vulnerabilities exist in the Session Initiation Protocol SIP implementation in Cisco IOS that can be exploited remotely to trigger a memory leak or to cause a reload of the IOS device. Cisco has released free software updates that address these vulnerabilities. Fixed Cisco IOS software...

Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerability (cisco-sa-20090923-sip)

A vulnerability exists in the Session Initiation Protocol SIP implementation in Cisco IOS Software that could allow an unauthenticated attacker to cause a denial of service DoS condition on an affected device when the Cisco Unified Border Element feature is enabled. Cisco has released free softwa...

Multiple Product Vulnerabilities Found by PROTOS SIP Test Suite - Cisco Systems

Multiple Cisco products contain vulnerabilities in the processing of Session Initiation Protocol SIP INVITE messages. These vulnerabilities were identified by the University of Oulu Secure Programming Group OUSPG "PROTOS" Test Suite for SIP and can be repeatedly exploited to produce a denial of...

Cisco Security Advisory: Cisco Unified Communications Manager Denial of Service Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Cisco Unified Communications Manager Denial of Service Vulnerabilities Advisory ID: cisco-sa-20100825-cucm Revision 1.0 For Public Release 2010 August 25 1600 UTC GMT...

Cisco Security Advisory: Cisco Unified Presence Denial of Service Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Cisco Security Advisory: Cisco Unified Presence Denial of Service Vulnerabilities Advisory ID: cisco-sa-20100825-cup Revision 1.0 For Public Release 2010 August 25 1600 UTC GMT +---------------------------------------------------------------------...

CVE-2010-2837

The SIPStationInit implementation in Cisco Unified Communications Manager aka CUCM, formerly CallManager 6.1SU before 6.15SU1, 7.0SU before 7.02aSU3, 7.1SU before 7.13bSU2, 7.1 before 7.15, and 8.0 before 8.01 allows remote attackers to cause a denial of service process failure via a malformed SI...

CVE-2010-2838

The SendCombinedStatusInfo implementation in Cisco Unified Communications Manager aka CUCM, formerly CallManager 7.0SU before 7.02aSU3, 7.1 before 7.15, and 8.0 before 8.03 allows remote attackers to cause a denial of service process failure via a malformed SIP REGISTER message, aka Bug ID...

Code injection

The SIPStationInit implementation in Cisco Unified Communications Manager aka CUCM, formerly CallManager 6.1SU before 6.15SU1, 7.0SU before 7.02aSU3, 7.1SU before 7.13bSU2, 7.1 before 7.15, and 8.0 before 8.01 allows remote attackers to cause a denial of service process failure via a malformed SI...

Command injection

The SendCombinedStatusInfo implementation in Cisco Unified Communications Manager aka CUCM, formerly CallManager 7.0SU before 7.02aSU3, 7.1 before 7.15, and 8.0 before 8.03 allows remote attackers to cause a denial of service process failure via a malformed SIP REGISTER message, aka Bug ID...

Code injection

The Presence Engine PE service in Cisco Unified Presence 6.x before 6.07 and 7.x before 7.08 does not properly handle an erroneous Contact field in the header of a SIP SUBSCRIBE message, which allows remote attackers to cause a denial of service process failure via a malformed message, aka Bug ID...

CVE-2010-2840

The Presence Engine PE service in Cisco Unified Presence 6.x before 6.07 and 7.x before 7.08 does not properly handle an erroneous Contact field in the header of a SIP SUBSCRIBE message, which allows remote attackers to cause a denial of service process failure via a malformed message, aka Bug ID...

CVE-2010-2839

SIPD in Cisco Unified Presence 6.x before 6.07 and 7.x before 7.08 allows remote attackers to cause a denial of service stack memory corruption and process failure via a malformed SIP message, aka Bug ID CSCtd14474...

CVE-2010-2840

Cisco CVE-2010-2840 affects the Presence Engine (PE) service in Cisco Unified Presence 6.x before 6.0(7) and 7.x before 7.0(8). A malformed SIP SUBSCRIBE header with an erroneous Contact field can cause a DoS (process failure). The issue is resolved in 6.0(7) and 7.0(8) by official fixes; no expl...

CVE-2010-2838

CVE-2010-2838 affects Cisco Unified Communications Manager (CUCM). The vulnerability is caused by the SendCombinedStatusInfo implementation in CUCM’s SIP handling, where a malformed SIP REGISTER message can trigger a denial of service (process failure). Affected CUCM versions are 7.0(2a)SU3, 7.1(...

CVE-2010-2837

CVE-2010-2837 affects Cisco Unified Communications Manager (CUCM) via the SIPStationInit code; a malformed SIP message can trigger a remote denial of service (process failure). Affected CUCM versions include 6.x, 7.x, and 8.x; fixes are in 6.1(5)SU1, 7.0(2a)SU3, 7.1(3b)SU2, 7.1(5), and 8.0(1). Ci...

CVE-2010-2837

The SIPStationInit implementation in Cisco Unified Communications Manager aka CUCM, formerly CallManager 6.1SU before 6.15SU1, 7.0SU before 7.02aSU3, 7.1SU before 7.13bSU2, 7.1 before 7.15, and 8.0 before 8.01 allows remote attackers to cause a denial of service process failure via a malformed SI...

Cisco Releases Advisories for Unified Communications Manager and Unified Presence

Cisco has released security advisories to address multiple vulnerabilities affecting Unified Communications Manager and Unified Presence. These vulnerabilities affect the processing of Session Initiation Protocol SIP messages. Exploitation of these vulnerabilities may allow an attacker to cause a...

CVE-2010-2825

Unspecified vulnerability in the SIP inspection feature on the Cisco Application Control Engine ACE Module with software A21.x before A21.6, A22.x before A22.3, and A23.x before A23.1 for Catalyst 6500 series switches and 7600 series routers, and the Cisco Application Control Engine ACE 4710...