PT-2015-4781 · Cisco · Cisco Telepresence Video Communication Server+2

Published 2015-03-13 · Updated 2015-09-11 · CVE-2015-0652

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Video Communication Server (VCS) versions prior to X8.2 Cisco Expressway versions prior to X8.2 Cisco TelePresence Conductor versions prior to XC2.4

Description The issue is related to the Session Description Protocol (SDP) implementation, which allows remote attackers to cause a denial of service. This can be achieved by sending a crafted media description, resulting in a mishandled exception and device reload.

Recommendations For Cisco TelePresence Video Communication Server (VCS) versions prior to X8.2, update to version X8.2 or later. For Cisco Expressway versions prior to X8.2, update to version X8.2 or later. For Cisco TelePresence Conductor versions prior to XC2.4, update to version XC2.4 or later.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2015-0652

Affected Products

Cisco Expressway

Cisco Telepresence Conductor

Cisco Telepresence Video Communication Server

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2015-0652 · Security Note
• http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150311-vcs · Vendor Advisory
• http://securitytracker.com/id/1031910 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0652 · Note