>> Cisco Unified Communications Manager Code Execution and DoS Issues
Title : Cisco Unified Communications Manager Code Execution and DoS Issues VUPEN ID : VUPEN/ADV-2007-3532 CVE ID : CVE-2007-5537 - CVE-2007-5538
Rated as : Moderate Risk
Remotely Exploitable : Yes Locally Exploitable : Yes Release Date : 2007-10-18
Technical Description
Multiple vulnerabilities have been identified in Cisco Unified Communications Manager (CUCM), formerly CallManager, which could be exploited by attackers to cause a denial of service or execute arbitrary code.
The first issue is caused by an error in the Session Initiation Protocol (SIP) stack when processing a flood of SIP INVITE messages sent to port 5060/UDP, which could be exploited by attackers to trigger a resource exhaustion condition that will result in a kernel panic.
The second vulnerability is caused by a buffer overflow error in the Centralized TFTP File Locator Service component of the CUCM TFTP service when processing specially crafted filenames, which could be exploited by unauthenticated attackers to cause a denial of service or execute arbitrary code. The CUCM TFTP service disabled by default.
Subscribe to VUPEN VNS and receive real-time e-mail and SMS alerts when new advisories or patches relevant to your systems and network configurations are available.
Feedback If you have additional information or corrections for this security advisory please submit them via our contact form.
