PT-2012-1011 · Cisco · Cisco Unified Communications Manager+2

Published 2012-09-26 · Updated 2017-08-29 · CVE-2012-3949

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager versions 6.x through 7.x before 7.1(5b)su5 Cisco Unified Communications Manager versions 8.x before 8.5(1)su4 Cisco Unified Communications Manager versions 8.6 before 8.6(2a)su1 Cisco IOS versions 12.2 through 12.4 Cisco IOS versions 15.0 through 15.2 Cisco IOS XE versions 3.3.xSG before 3.3.1SG Cisco IOS XE versions 3.4.xS Cisco IOS XE versions 3.5.xS

Description The SIP implementation in the affected software allows remote attackers to cause a denial of service via a crafted SIP message containing an SDP session description. This is due to insufficient input processing. The vulnerability can be exploited by sending a specially crafted SIP packet with a specified SDP session descriptor, potentially causing a service crash or device reload. Affected devices must be configured to process SIP messages and for pass-through of Session Description Protocol (SDP) for this vulnerability to be exploitable.

Recommendations For Cisco Unified Communications Manager versions 6.x through 7.x before 7.1(5b)su5, update to version 7.1(5b)su5 or later. For Cisco Unified Communications Manager versions 8.x before 8.5(1)su4, update to version 8.5(1)su4 or later. For Cisco Unified Communications Manager versions 8.6 before 8.6(2a)su1, update to version 8.6(2a)su1 or later. For Cisco IOS versions 12.2 through 12.4, update to a version outside of this range. For Cisco IOS versions 15.0 through 15.2, update to a version outside of this range. For Cisco IOS XE versions 3.3.xSG before 3.3.1SG, update to version 3.3.1SG or later. As a temporary workaround, consider restricting the processing of SIP messages and SDP pass-through to minimize the risk of exploitation.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2014-00035

CVE-2012-3949

Affected Products

Cisco Ios

Cisco Ios Xe

Cisco Unified Communications Manager

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2012-3949 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120926-sip · Vendor Advisory
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120926-sip · Vendor Advisory
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120926-cucm · Vendor Advisory
• https://bdu.fstec.ru/vul/2014-00035 · Security Note
• http://securityfocus.com/bid/55697 · Note
• http://osvdb.org/85816 · Note
• http://secunia.com/advisories/50774 · Note