PT-2017-12483 · Cisco · Cisco Meeting Server

Published 2017-11-16 · Updated 2019-10-09 · CVE-2017-12311

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Cisco Meeting Server (affected versions not specified)

Description A vulnerability in the H.264 decoder function could allow an unauthenticated, remote attacker to cause a Cisco Meeting Server media process to restart unexpectedly when it receives an illegal H.264 frame. The issue is triggered by an H.264 frame with an invalid picture parameter set (PPS) value. An attacker could exploit this by sending a malformed H.264 frame, potentially causing a denial of service (DoS) condition due to the media process restart. The media session should re-establish within a few seconds, with a brief interruption in service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-399

CWE-20

Related Identifiers

CVE-2017-12311

Affected Products

Cisco Meeting Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-12311 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171115-cms · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-12311 · Vendor Advisory
• http://securitytracker.com/id/1039827 · Note
• http://securityfocus.com/bid/101855 · Note