PT-2009-5228 · Cisco · Cisco Ios

Published 2009-09-23 · Updated 2009-10-01 · CVE-2009-2870

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 12.2 through 12.4

Description A vulnerability exists in the Session Initiation Protocol (SIP) implementation in Cisco IOS Software, allowing an unauthenticated attacker to cause a denial of service (DoS) condition on an affected device when the Cisco Unified Border Element feature is enabled. This can be achieved via crafted SIP messages.

Recommendations For devices running Cisco IOS versions 12.2 through 12.4 with the Cisco Unified Border Element feature enabled, update to a version that includes the software updates released by Cisco to address this vulnerability. If updating is not feasible, consider mitigations available to limit exposure of the vulnerability, as outlined in the Cisco Security Advisory.

Fix

Related Identifiers

CVE-2009-2870

Affected Products

Cisco Ios

References · 6

• http://tools.cisco.com/security/center/viewAlert.x?alertId=18891 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-2870 · Security Note
• http://cisco.com/en/US/products/products_security_advisory09186a0080af811b.shtml · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20090923-sip · Vendor Advisory
• http://securitytracker.com/id?1022930 · Note
• http://vupen.com/english/advisories/2009/2759 · Note