PT-2020-1759 · Cisco · Cisco Unified Contact Center Enterprise

Published 2020-02-19 · Updated 2020-02-24 · CVE-2020-3163

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco Unified Contact Center Enterprise (affected versions not specified)

Description A vulnerability in the Live Data server could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The issue exists because the affected software improperly manages resources when processing inbound Live Data traffic. An attacker could exploit this by sending multiple crafted Live Data packets to an affected device, potentially causing the device to run out of buffer resources, leading to a stack overflow and resulting in a DoS condition. The Live Data port allows only a single TCP connection, so an attacker would have to send crafted packets before a legitimate Live Data client establishes a connection.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

BDU:2020-00999

CVE-2020-3163

Affected Products

Cisco Unified Contact Center Enterprise

References · 4

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucce-tip-dos-7cdLUASb · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00999 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-3163 · Security Note
• https://osv.dev/vulnerability/CVE-2020-3163 · Vendor Advisory