PT-2012-2520 · Cisco · Cisco Ip Communicator+1

Published 2012-05-02 · Updated 2012-10-30 · CVE-2012-0361

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Cisco IP Communicator versions 7.0 through 8.6

Description The issue concerns the sccp-protocol component, which does not limit the rate of SCCP messages to Cisco Unified Communications Manager. This allows remote attackers to cause a denial of service via vectors that trigger on hook and off hook messages.

Recommendations For Cisco IP Communicator versions 7.0 through 8.6, consider implementing rate limiting for SCCP messages to Cisco Unified Communications Manager as a temporary workaround to minimize the risk of denial of service attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-0361

Affected Products

Cisco Ip Communicator

Cisco Unified Communications Manager

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2012-0361 · Security Note
• http://cisco.com/en/US/docs/voice_ip_comm/cipc/8_5/english/release_notes/CIPC8x_RN.html · Note
• http://securitytracker.com/id?1027013 · Note