Cisco patches serious vulnerabilities in Unified Communications Manager
The vulnerabilities can be exploited by attackers to execute arbitrary commands or disrupt telephony-related services, Cisco said
IDG News Service - Cisco Systems released new security patches for several versions of Unified Communications Manager (UCM) to address vulnerabilities that could allow remote attackers to execute arbitrary commands, modify system data or disrupt services.
The UCM is the call processing component of Cisco's IP Telephony solution. It connects to IP (Internet Protocol) phones, media processing devices, VoIP gateways, and multimedia applications and provides services such as session management, voice, video, messaging, mobility, and web conferencing.
The most serious vulnerability addressed by the newly released patches can lead to a buffer overflow and is identified as CVE-2013-3462 in the Common Vulnerabilities and Exposures database. This vulnerability can be exploited remotely, but it requires the attacker to be authenticated on the device.
"An attacker could exploit this vulnerability by overwriting an allocated memory buffer on an affected device," Cisco said Wednesday in a security advisory. "An exploit could allow the attacker to corrupt data, disrupt services, or run arbitrary commands."
The CVE-2013-3462 vulnerability affects versions 7.1(x), 8.5(x), 8.6(x), 9.0(x) and 9.1(x) of Cisco UCM, Cisco said.
The company also patched three denial-of-service (DoS) flaws that can be remotely exploited by unauthenticated attackers.
One of them, identified as CVE-2013-3459, is caused by improper error handling and can be exploited by sending malformed registration messages to the affected devices. The flaw only affects Cisco UCM 7.1(x) versions.
The second DoS issue is identified as CVE-2013-3460 and is caused by insufficient limiting of traffic received on certain UDP ports. It can be exploited by sending UDP packets at a high rate on those specific ports to devices running versions 8.5(x), 8.6(x), and 9.0(x) of Cisco UCM.
The third vulnerability, identified as CVE-2013-3461, is similar but only affects the Session Initiation Protocol (SIP) port. "An attacker could exploit this vulnerability by sending UDP packets at a high rate to port 5060 on an affected device," Cisco said. The vulnerability affects Cisco UCM versions 8.5(x), 8.6(x) and 9.0(1).
Patched versions have been released for all UCM release branches affected by these vulnerabilities and there are no known workarounds at the time that would mitigate the flaws without upgrading.
All of the patched vulnerabilities were discovered during internal testing and the company's product security incident response team (PSIRT) is not aware of any cases where these issues have been exploited or publicly documented.
"In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release," Cisco said. "If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers."
- Who's Spying on You? You're aware of the threats of malware to your business but what about the ever-changing ground rules? Cybercriminals today are launching attacks against...
- The Business Value of Continuous Delivery Download this whitepaper to learn more about the business value of Continuous Delivery and see why it could be a game changer for...
- Ten Factors Shaping the Future of Application Delivery Download this research report conducted by Enterprise Management Associates (EMA) to learn how those that are seeking to accelerate application delivery are leveraging...
- Software Asset Management: Ensuring Today's Assets Today's trends like BYOD and SaaS are new and exciting in terms of how they will help make our jobs more productive but...
- On-demand webinar - 7 Keys to Service Catalog Implementation Success Watch this webinar to learn 7 crucial keys to make your service catalog a success!
- Transform Your IT Service Management Watch this webinar, to learn how EasyVista can increase IT productivity & efficiency and deliver streamlined & integrated IT Service & Asset Mgmt. All Malware and Vulnerabilities White Papers | Webcasts