PT-2018-13011 · Cisco · Cisco Unity Connection

Publicado 2018-10-05 · Atualizado 2019-10-09 · CVE-2018-15396

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco Unity Connection (affected versions not specified)

Description A vulnerability in the Bulk Administration Tool (BAT) for Cisco Unity Connection could allow an authenticated, remote attacker to cause high disk utilization, resulting in a denial of service (DoS) condition. This issue arises because the affected software does not restrict the maximum size of certain files that can be written to disk. An attacker with valid administrator credentials could exploit this by sending a crafted, remote connection request. A successful exploit could allow the attacker to write a file that consumes most of the available disk space, causing application functions to operate abnormally and leading to a DoS condition.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

CWE-399

Identificadores relacionados

CVE-2018-15396

Produtos afetados

Cisco Unity Connection

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-15396 · Nota de Segurança
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-unity-dos · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-15396 · Aviso do Fabricante
• http://securitytracker.com/id/1041782 · Nota