PT-2017-16123 · Cisco · Cisco Telepresence Collaboration Endpoint

Publicado 2017-05-16 · Atualizado 2017-07-11 · CVE-2017-3825

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Collaboration Endpoint (CE) Software versions CE8.1.1 through CE8.3.1

Description A vulnerability in the ICMP ingress packet processing could allow an unauthenticated, remote attacker to cause the TelePresence endpoint to reload unexpectedly, resulting in a denial of service (DoS) condition. This is due to incomplete input validation for the size of a received ICMP packet. An attacker could exploit this by sending a crafted ICMP packet to the local IP address of the targeted endpoint, potentially causing calls to be dropped. The vulnerability affects either IPv4 or IPv6 ICMP traffic.

Recommendations For versions CE8.1.1 through CE8.3.1, update to a fixed software release to resolve the issue.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2017-3825

Produtos afetados

Cisco Telepresence Collaboration Endpoint

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-3825 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-3825 · Aviso do Fabricante
• http://securitytracker.com/id/1038392 · Nota
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170503-ctp · Aviso do Fabricante
• http://securityfocus.com/bid/98293 · Nota