PT-2010-4329 · Cisco · Cisco Unified Communications Manager+2

Publicado 2010-09-22 · Atualizado 2010-09-24 · CVE-2010-2834

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 12.2 through 12.4 and 15.0 through 15.1 Cisco IOS XE versions 2.5.x and 2.6.x before 2.6.1 Cisco Unified Communications Manager versions 6.x before 6.1(5)SU1, 7.x before 7.1(5), and 8.0 before 8.0(2)

Description Multiple vulnerabilities exist in the Session Initiation Protocol (SIP) implementation in Cisco IOS Software that could allow an unauthenticated, remote attacker to cause a reload of an affected device when SIP operation is enabled. The issue can be triggered via crafted SIP registration traffic over UDP.

Recommendations For Cisco IOS versions 12.2 through 12.4 and 15.0 through 15.1, update to a fixed version to address the vulnerabilities. For Cisco IOS XE versions 2.5.x and 2.6.x before 2.6.1, update to version 2.6.1 or later. For Cisco Unified Communications Manager versions 6.x before 6.1(5)SU1, 7.x before 7.1(5), and 8.0 before 8.0(2), update to the respective fixed versions, 6.1(5)SU1, 7.1(5), or 8.0(2), to mitigate the issue. As a temporary workaround, consider disabling SIP operation on affected devices until a patch is available. Restrict access to SIP registration traffic over UDP to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2010-2834

Produtos afetados

Cisco Ios

Cisco Ios Xe

Cisco Unified Communications Manager

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2010-2834 · Nota de Segurança
• http://cisco.com/en/US/products/products_security_advisory09186a0080b4a313.shtml · Aviso do Fabricante
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20100922-sip · Aviso do Fabricante
• http://cisco.com/en/US/products/products_security_advisory09186a0080b4a30f.shtml · Aviso do Fabricante