|
|
|
|
| |
Cisco Unified Communications Manager (CUCM), formerly CallManager, contains two overflow vulnerabilities that could allow a remote, unauthenticated user to cause a denial of service (DoS) condition or execute arbitrary code.
A workaround exists for one of the vulnerabilities. |
| |
Credit:
The information has been provided by Cisco Systems Product Security Incident Response Team.
The original article can be found at: http://www.cisco.com/warp/public/707/cisco-sa-20070711-cucm.shtml
|
| |
Affected Products:
Note: Cisco Unified CallManager versions 4.2, 4.3, 5.1 and 6.0 have been renamed as Cisco Unified Communications Manager. CUCM versions 3.3, 4.0, 4.1 and 5.0 retain the Cisco Unified CallManager name.
Vulnerable Products
These products are vulnerable:
* Cisco Unified CallManager 3.3 versions prior to 3.3(5)SR3
* Cisco Unified CallManager 4.1 versions prior to 4.1(3)SR5
* Cisco Unified CallManager 4.2 versions prior to 4.2(3)SR2
* Cisco Unified Communications Manager 4.3 versions prior to 4.3(1)SR1
* Cisco Unified CallManager 5.0 and Communications Manager 5.1 versions prior to 5.1(2)
Administrators of systems running CUCM version 3.x and 4.x can determine the software version by navigating to Help > About Cisco Unified CallManager and selecting the Details button via the CUCM Administration interface.
Administrators of systems running CUCM version 5.0 can determine the software version by viewing the main page of the CUCM Administration interface. The software version can also be determined by running the command show version active via the Command Line Interface (CLI).
Products Confirmed Not Vulnerable
Cisco Unified Communications Manager version 6.0 and Cisco CallManager Express are not affected by these vulnerabilities. No other Cisco products are currently known to be affected by these vulnerabilities.
Details:
Cisco Unified Communications Manager (CUCM), formerly CallManager, is the call processing component of the Cisco IP telephony solution that extends enterprise telephony features and functions to packet telephony network devices, such as IP phones, media processing devices, voice-over-IP (VoIP) gateways, and multimedia applications.
* CTL Provider Service Overflow
The Certificate Trust List (CTL) Provider service of CUCM contains a heap overflow vulnerability that could allow a remote, unauthenticated user to cause a DoS condition or execute arbitrary code. The CTL Provider service listens on TCP port 2444 by default, but the port is user-configurable. This vulnerability is corrected in CUCM versions 4.1(3)SR5, 4.2(3)SR2, 4.3(1)SR1 and 5.1(2). CUCM 3.x versions are not affected by this vulnerability. This issue is documented in Cisco Bug ID CSCsi03042.
* RIS Data Collector Heap Overflow
The Real-Time Information Server (RIS) Data Collector service of CUCM contains a heap overflow vulnerability that could allow a remote, unauthenticated user to cause a DoS condition or execute arbitrary code. The RIS Data Collector process listens on TCP port 2556 by default, but the port is user-configurable. This vulnerability is corrected in CUCM versions 3.3(5)SR2b, 4.1(3)SR5, 4.2(3)SR2, 4.3(1)SR1 and 5.1(2). This issue is documented in Cisco Bug ID CSCsi10509.
Impact:
Successful exploitation of these vulnerabilities may result in a DoS condition or the execution of arbitrary code.
Workarounds:
It is possible to workaround the CTL Provider Service Overflow vulnerability by disabling the CTL Provider Service if it is not needed. Access to the CTL Provider Service is usually only required during the initial configuration of CUCM authentication and encryption features. For CUCM 4.x systems, please consult the following documentation for details on how to disable CUCM services:
http://www.cisco.com/en/US/products/sw/voicesw/ps556/products_administration_guide_chapter09186a008070ec49.html
For CUCM 5.x systems, please consult the following documentation for details on how to disable CUCM services:
http://www.cisco.com/en/US/products/sw/voicesw/ps556/products_administration_guide_chapter09186a008037ced2.html#wp1048220
Filtering traffic to affected CUCM systems on screening devices can be used as a mitigation technique for both vulnerabilities:
* Permit access to TCP port 2444 only between the CUCM systems where the CTL Provider service is active and the CTL Client, usually on the administrator's workstation, to mitigate the CTL Provider service overflow.
* Permit access to TCP port 2556 only from other CUCM cluster systems to mitigate the RIS Data Collector overflow.
It is possible to change the default ports of the CTL Provider (2444/TCP) and RIS Data Collector (2556/TCP) services. If changed, filtering should be based on the values used. The values of the ports can be viewed in CUCM Administration interface by following the System > Service Parameters menu and selecting the appropriate service.
There is currently no method to configure filtering directly on a CUCM system.
Although it is often difficult to block traffic transiting your network, it is possible to identify traffic that should never be allowed to target your infrastructure devices and block that traffic at the border of your network. Infrastructure ACLs are considered a network security best practice and should be considered as a long-term addition to good network security, as well as a workaround for this specific vulnerability. The filters shown above should be included as part of an infrastructure access list which will protect all devices with IP addresses in the infrastructure IP address range.
The white paper entitled "Protecting Your Core: Infrastructure Protection Access Control Lists" presents guidelines and recommended deployment techniques for infrastructure protection access lists. This document is available at the following link:
http://www.cisco.com/en/US/tech/tk648/tk361/technologies_white_paper09186a00801a1a55.shtml
Filters blocking access to TCP/2444 and TCP/2556 should be deployed at the network edge as part of a transit access list which will protect the router where the ACL is configured, as well as other devices behind it. Further information about transit ACLs is available in the white paper "Transit Access Control Lists: Filtering at Your Edge," which is available at the following link:
http://www.cisco.com/en/US/tech/tk648/tk361/technologies_white_paper09186a00801afc76.shtml
Additional mitigations that can be deployed on Cisco devices within the network are available in the Cisco Applied Intelligence companion document for this advisory:
http://www.cisco.com/warp/public/707/cisco-air-20070711-cucm.shtml
|
|
|
|
|
|
|
|
|
|
