PT-2013-2944 · Cisco · Cisco Telepresence Mcu Mse 8510+3

Published 2013-04-18 · Updated 2013-04-19 · CVE-2013-1176

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco TelePresence MCU 4500 versions prior to 4.3(2.30) Cisco TelePresence MCU 4501 versions prior to 4.3(2.30) Cisco TelePresence MCU MSE 8510 versions prior to 4.3(2.30) Cisco TelePresence Server versions prior to 2.3(1.55)

Description The issue allows remote attackers to cause a denial of service, resulting in a device reload, by sending crafted RTP packets in a SIP session or an H.323 session. This is due to the DSP card not properly validating H.264 data.

Recommendations For Cisco TelePresence MCU 4500 versions prior to 4.3(2.30), update to version 4.3(2.30) or later. For Cisco TelePresence MCU 4501 versions prior to 4.3(2.30), update to version 4.3(2.30) or later. For Cisco TelePresence MCU MSE 8510 versions prior to 4.3(2.30), update to version 4.3(2.30) or later. For Cisco TelePresence Server versions prior to 2.3(1.55), update to version 2.3(1.55) or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2013-1176

Affected Products

Cisco Telepresence Mcu 4500

Cisco Telepresence Mcu 4501

Cisco Telepresence Mcu Mse 8510

Cisco Telepresence Server

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2013-1176 · Security Note
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130417-tpi · Vendor Advisory