PatchAdvisor Vulnerability Alert - Cisco CallManager Remote Denial of Service Vulnerability
PatchAdvisor, Inc. www.patchadvisor.com
PATCHADVISOR VULNERABILITY ALERT
Cisco CallManager CTI Manager Remote Denial Of Service Vulnerability
VULNERABILITY NAME
==================
Cisco CallManager CTI Manager Remote Denial Of Service Vulnerability
PUBLISHED DATE
==============
12-JUL-05
UPDATED DATE
============
19-JUL-05
BACKGROUND
==========
Cisco Call Manager (CCM) is the software-based call-processing component of the
Cisco IP telephony solution which extends enterprise telephony features and
functions to packet telephony network devices such as IP phones, media
processing
devices, voice-over-IP (VoIP) gateways, and multimedia applications.
More information about the product is available here:
http://www.cisco.com/en/US/products/sw/voicesw/ps556/index.html
DESCRIPTION
===========
Cisco Call Manager may restart when more than 1GB of memory is used. Sending
specially crafted packets to the CCM will cause the CCM to use more than 1
gigabyte
of virtual memory.
An example of how to send a specially crafted packet is:
wget http://victim:2000
Cisco has allocated CSCee00116 for this vulnerability. Their bulletin is
available here:
http://www.cisco.com/warp/public/707/cisco-sa-20050712-ccm.shtml
IMPACT
======
Successful exploitation of the vulnerability may result in resource starvation
resulting
in high CPU utilization, unresponsive terminal services, the inability to run
CCM
Admin or to map drives. This may subsequently lead to phones not responding,
phones
unregistering from the Cisco CallManager, or Cisco CallManager restarting. In
extreme examples, all VoIP phones may restart after only 1 packet being sent to
the
CCM.
VERSIONS AFFECTED
=================
Cisco CallManager 3.2 and earlier
Cisco CallManager 3.3, versions earlier than 3.3(5)
Cisco CallManager 4.0, versions earlier than 4.0(2a)SR2b
Cisco CallManager 4.1, versions earlier than 4.1(3)SR1
SOLUTION
========
Upgrade to version Call Manager 3.3(5) or 4.1(4)
Vulnerability History
=====================
21 April 2005 Identified by Jeff Fay of PatchAdvisor
21 April 2005 Issue disclosed to Cisco
25 April 2005 Vulnerability confirmed Cisco
12 July 2005 Cisco Public Disclosure
UPDATES
=======
Further updates to this notice will be posted to the PatchAdvisor site
http://www.patchadvisor.com
CREDIT
======
Jeff Fay of PatchAdvisor (Jeff@xxxxxxxxxxxxxxxx)
ABOUT PATCHADVISOR
==================
PatchAdvisor, Inc. was founded in 2003 and is based in Alexandria, Virginia
with
offices in Maryland and Florida. Our corporate philosophy is simple, we
empower
clients with the knowledge and tools they need to secure their environment.
Our
products and services go beyond the rest by providing not only an understanding
of
security issues, but also providing lasting solutions tailored for each unique
environment so clients can quickly focus on the task of securing their
environment.
Request a free trial of our vulnerability alerting solution by clicking here:
http://www.patchadvisor.com/Products/Default.aspx
DISCLAIMER
==========
This information is provided in an AS IS condition and may change without
notice. There are no warranties with regard to this information. Neither
PatchAdvisor nor the author are liable for any consequences arising from either
following or not following this information.
Copyright 2005 PatchAdvisor Inc. All rights reserved. www.patchadvisor.com