PT-2018-8596 · Cisco · Cisco Virtualized Voice Browser+1

Published 2018-01-18 · Updated 2019-10-09 · CVE-2018-0086

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Cisco Unified Customer Voice Portal versions prior to 11.6(1)

Description: A denial of service condition can be caused by an unauthenticated, remote attacker due to malformed SIP INVITE traffic received during communications with the Cisco Virtualized Voice Browser. The attacker can exploit this by sending malformed SIP INVITE traffic, impacting the availability of services and data on the device.

Recommendations: For versions prior to 11.6(1), update to version 11.6(1) or later to resolve the issue. As a temporary workaround, consider restricting access to the application server to minimize the risk of exploitation.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2018-0086

Affected Products

Cisco Unified Customer Voice Portal

Cisco Virtualized Voice Browser

References · 5

• https://osv.dev/vulnerability/CVE-2018-0086 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-0086 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-cvp · Vendor Advisory
• http://securitytracker.com/id/1040220 · Note
• http://securityfocus.com/bid/102745 · Note