PT-2012-5975 · Cisco · Cisco Unified Ip Phone 7900 Series

Ang Cui · Published 2012-12-28 · Updated 2013-03-04 · CVE-2012-5445

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Unified IP Phone 7900 series devices (aka TNP phones) versions prior to 9.3.1-ES10

Description The issue is related to the kernel in Cisco Native Unix (CNU) not properly validating system calls, which can be exploited by attackers to execute arbitrary code or cause a denial of service through a crafted binary, resulting in a memory overwrite.

Recommendations For versions prior to 9.3.1-ES10, update to version 9.3.1-ES10 or later to resolve the issue.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2012-5445

Affected Products

Cisco Unified Ip Phone 7900 Series

References · 4

• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130109-uipphone · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-5445 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5445 · Note
• http://events.ccc.de/congress/2012/Fahrplan/events/5400.en.html · Note