PT-2007-5485 · Cisco · Cisco Unified Communications Manager+1

Published 2007-08-08 · Updated 2017-09-29 · CVE-2007-4294

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager versions 5.0 through 6.0 Cisco IOS versions 12.0 through 12.4

Description The issue allows remote attackers to execute arbitrary code via a malformed SIP packet. Multiple voice-related vulnerabilities are identified in Cisco IOS software and Cisco Unified Communications Manager, pertaining to protocols or features such as Session Initiation Protocol (SIP), Media Gateway Control Protocol (MGCP), H.323, H.254, Real-time Transport Protocol (RTP), and facsimile reception.

Recommendations For Cisco Unified Communications Manager versions 5.0 through 6.0, update to a fixed version of the software. For Cisco IOS versions 12.0 through 12.4, update to a fixed version of the software. As a temporary workaround, consider disabling the affected protocols or features, such as SIP, MGCP, H.323, H.254, RTP, and facsimile reception, until a patch is available.

Fix

Related Identifiers

CVE-2007-4294

Affected Products

Cisco Ios

Cisco Unified Communications Manager

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2007-4294 · Security Note
• http://secunia.com/advisories/26362 · Vendor Advisory
• http://cisco.com/en/US/products/products_security_advisory09186a0080899653.shtml · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20070808-IOS-voice · Vendor Advisory
• http://securityfocus.com/bid/25239 · Note
• http://osvdb.org/36693 · Note
• http://vupen.com/english/advisories/2007/2816 · Note
• http://securitytracker.com/id?1018538 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5851 · Note