July 2007
Cisco Security Advisories - Unified Communications Manager
ID: 160
Ref: 105/2007
Date: 12 July 2007:10:25:46
Version: 1
Title: Cisco Security Advisories - Unified Communications Manager
Abstract: Details of Unified Communications Manager and Presence Server Vulnerabilities
Vendors affected: Cisco
Applications affected: Cisco
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Cisco Security Advisory: Cisco Unified Communications Manager and Presence
Server Unauthorized Access Vulnerabilities
Document ID: 97060
Advisory ID: cisco-sa-20070711-voip
http://www.cisco.com/warp/public/707/cisco-sa-20070711-voip.shtml
Revision 1.0
For Public Release 2007 July 11 1600 UTC (GMT)
- - ---------------------------------------------------------------------
Contents
========
Summary
Affected Products
Details
Vulnerability Scoring Details
Impact
Software Version and Fixes
Workarounds
Obtaining Fixed Software
Exploitation and Public Announcements
Status of this Notice: FINAL
Distribution
Revision History
Cisco Security Procedures
- - ---------------------------------------------------------------------
Summary
=======
Cisco Unified Communications Manager (CUCM), formerly CallManager, and Cisco
Unified Presence Server (CUPS) contain two vulnerabilities that could allow an
unauthorized administrator to activate and terminate CUCM / CUPS system
services and access SNMP configuration information. This may respectively
result in a denial of service
(DoS) condition affecting CUCM/CUPS cluster systems and the disclosure of
sensitive SNMP details, including community strings.
There are no workarounds for these vulnerabilities.
Cisco has made free software available to address these vulnerabilities for
affected customers.
This advisory is posted at
http://www.cisco.com/warp/public/707/cisco-sa-20070711-voip.shtml
Affected Products
=================
Note: Cisco Unified CallManager versions 4.2, 4.3, 5.1 and 6.0 have been
renamed as Cisco Unified Communications Manager. CUCM versions 3.3, 4.0, 4.1
and 5.0 retain the Cisco Unified CallManager name.
Vulnerable Products
+------------------
These products are vulnerable:
* Cisco Unified CallManager 5.0 and Communications Manager 5.1
versions up to and including 5.1(2)
* Cisco Unified Presence Server 1.0 versions up to and including
1.0(3)
Administrators of systems running CUCM version 5.x and CUPS version 1.x can
determine the software version by viewing the main page of the CUCM/CUPS
Administration interface. The software version can also be determined by
running the command show version active via the Command Line Interface (CLI).
Products Confirmed Not Vulnerable
+--------------------------------
* Cisco Unified CallManager versions 3.3, 4.0, 4.1, 4.2
* Cisco Unified Communications Manager versions 4.3, 6.0
* Cisco Unified Presence Server version 6.0
No other Cisco products are currently known to be affected by these
vulnerabilities.
Details
=======
* Unauthorized Administrator Can Activate/Terminate CUCM/CUPS
System Services
An unauthorized CUCM/CUPS administrator may be able to activate
and terminate system services in a CUCM/CUPS cluster environment.
This may result in a denial of critical voice services. The
unauthorized administrator cannot make changes to or view the
configuration of the vulnerable CUCM/CUPS system, with the
exception of viewing SNMP settings, which is documented in the
next vulnerability. The CUCM issue is documented by Cisco Bug ID
CSCsj09859. The CUPS issue is documented by Cisco Bug ID
CSCsj19985.
* Unauthorized Administrator Can View CUCM/CUPS SNMP Settings
An unauthorized CUCM/CUPS administrator may be able to view
sensitive SNMP configuration information in a CUCM/CUPS cluster
environment. This may result in the disclosure of sensitive
information, including SNMP community strings. The CUCM issue is
documented in Cisco Bug ID CSCsj20668. The CUPS issue is
documented in Cisco Bug ID CSCsj25962.
Vulnerability Scoring Details
=============================
Cisco is providing scores for the vulnerabilities in this advisory based on
the Common Vulnerability Scoring System (CVSS). The CVSS scoring in this
Security Advisory is done in accordance with CVSS version 1.0.
Cisco will provide a base and temporal score. Customers can then compute
environmental scores to assist in determining the impact of the vulnerability
in individual networks.
Cisco PSIRT will set the bias in all cases to normal. Customers are encouraged
to apply the bias parameter when determining the environmental impact of a
particular vulnerability.
CVSS is a standards based scoring method that conveys vulnerability severity
and helps determine urgency and priority of response.
Cisco has provided an FAQ to answer additional questions regarding CVSS at
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to help compute the environmental
impact for individual networks at
http://intellishield.cisco.com/security/alertmanager/cvss
CSCsj09859 - Unauthorized administrators can start/stop CUCM services
CVSS Base Score - 7
Access Vector - Remote
Access Complexity - Low
Authentication - Not Required
Confidentiality Impact - Partial
Integrity Impact - Partial
Availability Impact - Partial
Impact Bias - Normal
CVSS Temporal Score - 5.8
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
CSCsj19985 - Unauthorized administrators can start/stop CUPS services
CVSS Base Score - 7
Access Vector - Remote
Access Complexity - Low
Authentication - Not Required
Confidentiality Impact - Partial
Integrity Impact - Partial
Availability Impact - Partial
Impact Bias - Normal
CVSS Temporal Score - 5.8
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
CSCsj20668 - Unauthorized administrators can view CUCM SNMP settings
CVSS Base Score - 2.3
Access Vector - Remote
Access Complexity - Low
Authentication - Not Required
Confidentiality Impact - Partial
Integrity Impact - None
Availability Impact - None
Impact Bias - Normal
CVSS Temporal Score - 1.9
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
CSCsj25962 - Unauthorized administrators can view CUPS SNMP settings
CVSS Base Score - 2.3
Access Vector - Remote
Access Complexity - Low
Authentication - Not Required
Confidentiality Impact - Partial
Integrity Impact - None
Availability Impact - None
Impact Bias - Normal
CVSS Temporal Score - 1.9
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
Impact
=====
Successful exploitation of the service activation/termination vulnerability
may result in a DoS condition affecting critical voice services. An attacker
could disable central CUCM services, effectively causing the complete
disruption of a CUCM cluster.
Successful exploitation of the SNMP settings vulnerability may result in the
disclosure of sensitive network configuration information, including SNMP
community strings. Using this information, an attacker may be able to leverage
access to sensitive information on other systems in the network. It is a
common practice in many enterprise environments to utilize standardized SNMP
community strings. This may compound the severity of this vulnerability.
Software Version and Fixes
==========================
When considering software upgrades, also consult http://www.cisco.com/go/psirt
and any subsequent advisories to determine exposure and a complete upgrade
solution.
In all cases, customers should exercise caution to be certain the devices to
be upgraded contain sufficient memory and that current hardware and software
configurations will continue to be supported properly by the new release. If
the information is not clear, contact the Cisco Technical Assistance Center
("TAC") or your contracted maintenance provider for assistance.
Workarounds
===========
There are no workarounds for these vulnerabilities. It is possible to mitigate
these vulnerabilities by permitting only trusted CUCM/CUPS cluster nodes and
administrator workstations to access TCP port 8443 on a vulnerable CUCM/CUPS
system.
Although it is often difficult to block traffic transiting your network, it is
possible to identify traffic which should never be allowed to target your
infrastructure devices and block that traffic at the border of your network.
Infrastructure ACLs are considered a network security best practice and should
be considered as a long-term addition to good network security, as well as a
workaround for this specific vulnerability. The filters shown above should be
included as part of an infrastructure access list, which will protect all
devices with IP addresses in the infrastructure IP address range.
The white paper entitled "Protecting Your Core: Infrastructure Protection
Access Control Lists" presents guidelines and recommended deployment
techniques for infrastructure protection access lists.
This document is available at the following link:
http://www.cisco.com/en/US/tech/tk648/tk361/technologies_white_paper09186a00801a1a55.shtml
Filters blocking access to TCP/8443 should be deployed at the network edge as
part of a transit access list that will protect the router where the ACL is
configured, as well as other devices behind it.
Further information about transit ACLs is available in the white paper
"Transit Access Control Lists: Filtering at Your Edge," which is available at
the following link:
http://www.cisco.com/en/US/tech/tk648/tk361/technologies_white_paper09186a00801afc76.shtml
Additional mitigations that can be deployed on Cisco devices within the
network are available in the Cisco Applied Intelligence companion document for
this advisory:
http://www.cisco.com/warp/public/707/cisco-air-20070711-voip.shtml
Obtaining Fixed Software
========================
Cisco will make free software available to address this vulnerability for
affected customers. This advisory will be updated as fixed software becomes
available. Prior to deploying software, customers should consult their
maintenance provider or check the software for feature set compatibility and
known issues specific to their environment.
Customers may only install and expect support for the feature sets they have
purchased. By installing, downloading, accessing or otherwise using such
software upgrades, customers agree to be bound by the terms of Cisco's
software license terms found at
http://www.cisco.com/public/sw-license-agreement.html, or as otherwise set
forth at Cisco.com Downloads at
http://www.cisco.com/public/sw-center/sw-usingswc.shtml
Do not contact either "psirt@cisco.com" or "security-alert@cisco.com"
for software upgrades.
CUCM 5.0 & 5.1 - First Fixed Release is CUCM 5.1(2a), download link:
http://www.cisco.com/pcgi-bin/tablebuild.pl/callmgr-51?psrtdcat20e2
CUPS 1.0 - First Fixed Release is CUPS 6.0(1) * download link:
http://www.cisco.com/pcgi-bin/tablebuild.pl/cups-60?psrtdcat20e2
* Development of CUPS version 1.0 is discontinued. Users should upgrade to
CUPS version 6.0 to obtain fixes for these vulnerabilities.
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through their regular
update channels. For most customers, this means that upgrades should be
obtained through the Software Center on Cisco's worldwide website at
http://www.cisco.com.
Customers using Third Party Support Organizations
+------------------------------------------------
Customers whose Cisco products are provided or maintained through prior or
existing agreement with third-party support organizations such as Cisco
Partners, authorized resellers, or service providers should contact that
support organization for guidance and assistance with the appropriate course
of action in regards to this advisory.
The effectiveness of any workaround or fix is dependent on specific customer
situations such as product mix, network topology, traffic behavior, and
organizational mission. Due to the variety of affected products and releases,
customers should consult with their service provider or support organization
to ensure any applied workaround or fix is the most appropriate for use in the
intended network before it is deployed.
Customers without Service Contracts
+----------------------------------
Customers who purchase direct from Cisco but who do not hold a Cisco service
contract and customers who purchase through third-party vendors but are
unsuccessful at obtaining fixed software through their point of sale should
get their upgrades by contacting the Cisco Technical Assistance Center (TAC).
TAC contacts are as follows.
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac@cisco.com
Have your product serial number available and give the URL of this notice as
evidence of your entitlement to a free upgrade. Free upgrades for non-contract
customers must be requested through the TAC.
Refer to http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml
for additional TAC contact information, including special localized telephone
numbers and instructions and e-mail addresses for use in various languages.
Exploitation and Public Announcements
=====================================
The Cisco PSIRT is not aware of any public announcements or malicious use of
the vulnerability described in this advisory.
These vulnerabilities were discovered internally by Cisco.
Status of this Notice: FINAL
============================
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF
GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS
FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS
LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO
CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that omits the
distribution URL in the following section is an uncontrolled copy, and may
lack important information or contain factual errors.
Distribution
============
This advisory is posted on Cisco's worldwide website at :
http://www.cisco.com/warp/public/707/cisco-sa-20070711-voip.shtml
In addition to worldwide web posting, a text version of this notice is
clear-signed with the Cisco PSIRT PGP key and is posted to the following
e-mail and Usenet news recipients.
* cust-security-announce@cisco.com
* first-teams@first.org
* bugtraq@securityfocus.com
* vulnwatch@vulnwatch.org
* cisco@spot.colorado.edu
* cisco-nsp@puck.nether.net
* full-disclosure@lists.grok.org.uk
* comp.dcom.sys.cisco@newsgate.cisco.com
Future updates of this advisory, if any, will be placed on Cisco's worldwide
website, but may or may not be actively announced on mailing lists or
newsgroups. Users concerned about this problem are encouraged to check the
above URL for any updates.
Revision History
================
+---------------------------------------+
| Revision | | Initial |
| 1.0 | 2007-July-11 | public |
| | | release. |
+---------------------------------------+
Cisco Security Procedures
=========================
Complete information on reporting security vulnerabilities in Cisco products,
obtaining assistance with security incidents, and registering to receive
security information from Cisco, is available on Cisco's worldwide website at
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html.
This includes instructions for press inquiries regarding Cisco security
notices. All Cisco security advisories are available at
http://www.cisco.com/go/psirt.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Darwin)
iD8DBQFGlQFj8NUAbBmDaxQRAhpYAJ914DvAxGqSmCI3ygA2vwDHYpd/+wCeJsaC
zLr4dVLsdxvfLHGknh7tO/o=
=Q6Fe
- -----END PGP SIGNATURE-----
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Cisco Security Advisory: Cisco Unified Communications Manager Overflow
Vulnerabilities
Document ID: 92015
Advisory ID: cisco-sa-20070711-cucm
http://www.cisco.com/warp/public/707/cisco-sa-20070711-cucm.shtml
Revision 1.0
For Public Release 2007 July 11 1600 UTC (GMT)
- - ---------------------------------------------------------------------
Contents
========
Summary
Affected Products
Details
Vulnerability Scoring Details
Impact
Software Version and Fixes
Workarounds
Obtaining Fixed Software
Exploitation and Public Announcements
Status of this Notice: FINAL
Distribution
Revision History
Cisco Security Procedures
- - ---------------------------------------------------------------------
Summary
=======
Cisco Unified Communications Manager (CUCM), formerly CallManager, contains
two overflow vulnerabilities that could allow a remote, unauthenticated user
to cause a denial of service (DoS) condition or execute arbitrary code.
A workaround exists for one of the vulnerabilities.
Cisco has made free software available to address these vulnerabilities for
affected customers.
This advisory is posted at
http://www.cisco.com/warp/public/707/cisco-sa-20070711-cucm.shtml
Affected Products
=================
Note: Cisco Unified CallManager versions 4.2, 4.3, 5.1 and 6.0 have been
renamed as Cisco Unified Communications Manager. CUCM versions 3.3, 4.0, 4.1
and 5.0 retain the Cisco Unified CallManager name.
Vulnerable Products
+------------------
These products are vulnerable:
* Cisco Unified CallManager 3.3 versions prior to 3.3(5)SR3
* Cisco Unified CallManager 4.1 versions prior to 4.1(3)SR5
* Cisco Unified CallManager 4.2 versions prior to 4.2(3)SR2
* Cisco Unified Communications Manager 4.3 versions prior to 4.3(1)
SR1
* Cisco Unified CallManager 5.0 and Communications Manager 5.1
versions prior to 5.1(2)
Administrators of systems running CUCM version 3.x and 4.x can determine the
software version by navigating to Help > About Cisco Unified CallManager and
selecting the Details button via the CUCM Administration interface.
Administrators of systems running CUCM version 5.0 can determine the software
version by viewing the main page of the CUCM Administration interface. The
software version can also be determined by running the command show version
active via the Command Line Interface (CLI).
Products Confirmed Not Vulnerable
+--------------------------------
Cisco Unified Communications Manager version 6.0 and Cisco CallManager Express
are not affected by these vulnerabilities. No other Cisco products are
currently known to be affected by these vulnerabilities.
Details
=======
Cisco Unified Communications Manager (CUCM), formerly CallManager, is the call
processing component of the Cisco IP telephony solution that extends
enterprise telephony features and functions to packet telephony network
devices, such as IP phones, media processing devices, voice-over-IP (VoIP)
gateways, and multimedia applications.
* CTL Provider Service Overflow
The Certificate Trust List (CTL) Provider service of CUCM
contains a heap overflow vulnerability that could allow a remote,
unauthenticated user to cause a DoS condition or execute
arbitrary code. The CTL Provider service listens on TCP port 2444
by default, but the port is user-configurable. This vulnerability
is corrected in CUCM versions 4.1(3)SR5, 4.2(3)SR2, 4.3(1)SR1 and
5.1(2). CUCM 3.x versions are not affected by this vulnerability.
This issue is documented in Cisco Bug ID CSCsi03042.
* RIS Data Collector Heap Overflow
The Real-Time Information Server (RIS) Data Collector service of
CUCM contains a heap overflow vulnerability that could allow a
remote, unauthenticated user to cause a DoS condition or execute
arbitrary code. The RIS Data Collector process listens on TCP
port 2556 by default, but the port is user-configurable. This
vulnerability is corrected in CUCM versions 3.3(5)SR2b, 4.1(3)
SR5, 4.2(3)SR2, 4.3(1)SR1 and 5.1(2). This issue is documented in
Cisco Bug ID CSCsi10509.
Vulnerability Scoring Details
=============================
Cisco is providing scores for the vulnerabilities in this advisory based on
the Common Vulnerability Scoring System (CVSS). The CVSS scoring in this
Security Advisory is done in accordance with CVSS version 1.0.
Cisco will provide a base and temporal score. Customers can then compute
environmental scores to assist in determining the impact of the vulnerability
in individual networks.
Cisco PSIRT will set the bias in all cases to normal. Customers are encouraged
to apply the bias parameter when determining the environmental impact of a
particular vulnerability.
CVSS is a standards based scoring method that conveys vulnerability severity
and helps determine urgency and priority of response.
Cisco has provided an FAQ to answer additional questions regarding CVSS at
http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html
Cisco has also provided a CVSS calculator to help compute the environmental
impact for individual networks at
http://intellishield.cisco.com/security/alertmanager/cvss.
CSCsi03042 - CallManager CTL Provider Service Overflow
CVSS Base Score - 10
Access Vector - Remote
Access Complexity - Low
Authentication - Not Required
Confidentiality Impact - Complete
Integrity Impact - Complete
Availability Impact - Complete
Impact Bias - Normal
CVSS Temporal Score - 8.3
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
CSCsi10509 - CallManager RIS Data Collector Heap Overflow
CVSS Base Score - 10
Access Vector - Remote
Access Complexity - Low
Authentication - Not Required
Confidentiality Impact - Complete
Integrity Impact - Complete
Availability Impact - Complete
Impact Bias - Normal
CVSS Temporal Score - 8.3
Exploitability - Functional
Remediation Level - Official-Fix
Report Confidence - Confirmed
Impact
======
Successful exploitation of these vulnerabilities may result in a DoS condition
or the execution of arbitrary code.
Software Version and Fixes
==========================
When considering software upgrades, also consult http://www.cisco.com/go/psirt
and any subsequent advisories to determine exposure and a complete upgrade
solution.
In all cases, customers should exercise caution to be certain the devices to
be upgraded contain sufficient memory and that current hardware and software
configurations will continue to be supported properly by the new release. If
the information is not clear, contact the Cisco Technical Assistance Center
("TAC") or your contracted maintenance provider for assistance.
Workarounds
===========
It is possible to workaround the CTL Provider Service Overflow vulnerability
by disabling the CTL Provider Service if it is not needed. Access to the CTL
Provider Service is usually only required during the initial configuration of
CUCM authentication and encryption features. For CUCM 4.x systems, please
consult the following documentation for details on how to disable CUCM
services:
http://www.cisco.com/en/US/products/sw/voicesw/ps556/products_administration_guide_chapter09186a008070ec49.html
For CUCM 5.x systems, please consult the following documentation for details
on how to disable CUCM services:
http://www.cisco.com/en/US/products/sw/voicesw/ps556/products_administration_guide_chapter09186a008037ced2.html#wp1048220
Filtering traffic to affected CUCM systems on screening devices can be used as
a mitigation technique for both vulnerabilities:
* Permit access to TCP port 2444 only between the CUCM systems
where the CTL Provider service is active and the CTL Client,
usually on the administrator's workstation, to mitigate the CTL
Provider service overflow.
* Permit access to TCP port 2556 only from other CUCM cluster
systems to mitigate the RIS Data Collector overflow.
It is possible to change the default ports of the CTL Provider (2444/
TCP) and RIS Data Collector (2556/TCP) services. If changed, filtering should
be based on the values used. The values of the ports can be viewed in CUCM
Administration interface by following the System > Service Parameters menu and
selecting the appropriate service.
There is currently no method to configure filtering directly on a CUCM system.
Although it is often difficult to block traffic transiting your network, it is
possible to identify traffic that should never be allowed to target your
infrastructure devices and block that traffic at the border of your network.
Infrastructure ACLs are considered a network security best practice and should
be considered as a long-term addition to good network security, as well as a
workaround for this specific vulnerability. The filters shown above should be
included as part of an infrastructure access list which will protect all
devices with IP addresses in the infrastructure IP address range.
The white paper entitled "Protecting Your Core: Infrastructure Protection
Access Control Lists" presents guidelines and recommended deployment
techniques for infrastructure protection access lists.
This document is available at the following link:
http://www.cisco.com/en/US/tech/tk648/tk361/technologies_white_paper09186a00801a1a55.shtml
Filters blocking access to TCP/2444 and TCP/2556 should be deployed at the
network edge as part of a transit access list which will protect the router
where the ACL is configured, as well as other devices behind it. Further
information about transit ACLs is available in the white paper "Transit Access
Control Lists: Filtering at Your Edge," which is available at the following
link:
http://www.cisco.com/en/US/tech/tk648/tk361/technologies_white_paper09186a00801afc76.shtml
Additional mitigations that can be deployed on Cisco devices within the
network are available in the Cisco Applied Intelligence companion document for
this advisory:
http://www.cisco.com/warp/public/707/cisco-air-20070711-cucm.shtml
Obtaining Fixed Software
========================
Cisco will make free software available to address this vulnerability for
affected customers. This advisory will be updated as fixed software becomes
available. Prior to deploying software, customers should consult their
maintenance provider or check the software for feature set compatibility and
known issues specific to their environment.
Customers may only install and expect support for the feature sets they have
purchased. By installing, downloading, accessing or otherwise using such
software upgrades, customers agree to be bound by the terms of Cisco's
software license terms found at
http://www.cisco.com/public/sw-license-agreement.html, or as otherwise set
forth at Cisco.com Downloads at
http://www.cisco.com/public/sw-center/sw-usingswc.shtml.
Do not contact either "psirt@cisco.com" or "security-alert@cisco.com"
for software upgrades.
Fixed software for CUCM can be obtained here:
CUCM 3.3 - First Fixed Release is CUCM 3.3(5)SR2b (Expected
Availability July 18), download link:
http://www.cisco.com/pcgi-bin/tablebuild.pl/callmgr-33?psrtdcat20e2
CUCM 4.0 - Upgrade to 4.1(3)SR5b or 4.2(3)SR@b
CUCM 4.1 - First Fixed Release is CUCM 4.1(3)SR5b, download link:
http://www.cisco.com/pcgi-bin/tablebuild.pl/callmgr-41?psrtdcat20e2
CUCM 4.2 - First Fixed Relesae is CUCM 4.2(3)SR2b, download link:
http://www.cisco.com/pcgi-bin/tablebuild.pl/callmgr-42?psrtdcat20e2
CUCM 4.3 - First Fixed Release is 4.3(1)SR1, download link:
http://www.cisco.com/pcgi-bin/tablebuild.pl/callmgr-43?psrtdcat20e2
CUCM 5.0 - Upgrade to CUCM 5.1(2a) *
CUCM 5.1 - First Fixed Release is CUCM 5.1(2a) *, download link:
http://www.cisco.com/pcgi-bin/tablebuild.pl/callmgr-51?psrtdcat20e2
* The vulnerabilities contained in this advisory were first fixed in CUCM
version 5.1(2). Users are encouraged to upgrade to CUCM 5.1(2a) or later to
obtain fixes for security vulnerabilities described in Cisco security
advisory:
http://www.cisco.com/warp/public/707/cisco-sa-20070711-cucm.shtml
Customers with Service Contracts
+-------------------------------
Customers with contracts should obtain upgraded software through their regular
update channels. For most customers, this means that upgrades should be
obtained through the Software Center on Cisco's worldwide website at
http://www.cisco.com.
Customers using Third Party Support Organizations
+------------------------------------------------
Customers whose Cisco products are provided or maintained through prior or
existing agreement with third-party support organizations such as Cisco
Partners, authorized resellers, or service providers should contact that
support organization for guidance and assistance with the appropriate course
of action in regards to this advisory.
The effectiveness of any workaround or fix is dependent on specific customer
situations such as product mix, network topology, traffic behavior, and
organizational mission. Due to the variety of affected products and releases,
customers should consult with their service provider or support organization
to ensure any applied workaround or fix is the most appropriate for use in the
intended network before it is deployed.
Customers without Service Contracts
+----------------------------------
Customers who purchase direct from Cisco but who do not hold a Cisco service
contract and customers who purchase through third-party vendors but are
unsuccessful at obtaining fixed software through their point of sale should
get their upgrades by contacting the Cisco Technical Assistance Center (TAC).
TAC contacts are as follows.
* +1 800 553 2447 (toll free from within North America)
* +1 408 526 7209 (toll call from anywhere in the world)
* e-mail: tac@cisco.com
Have your product serial number available and give the URL of this notice as
evidence of your entitlement to a free upgrade. Free upgrades for non-contract
customers must be requested through the TAC.
Refer to http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml
for additional TAC contact information, including special localized telephone
numbers and instructions and e-mail addresses for use in various languages.
Exploitation and Public Announcements
=====================================
The Cisco PSIRT is not aware of any public announcements or malicious use of
the vulnerability described in this advisory.
These vulnerabilities were reported to Cisco by the IBM Internet Security
Systems X-Force team.
Status of this Notice: FINAL
============================
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF
GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS
FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS
LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO
CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that omits the
distribution URL in the following section is an uncontrolled copy, and may
lack important information or contain factual errors.
Distribution
============
This advisory is posted on Cisco's worldwide website at :
http://www.cisco.com/warp/public/707/cisco-sa-20070711-cucm.shtml
In addition to worldwide web posting, a text version of this notice is
clear-signed with the Cisco PSIRT PGP key and is posted to the following
e-mail and Usenet news recipients.
* cust-security-announce@cisco.com
* first-teams@first.org
* bugtraq@securityfocus.com
* vulnwatch@vulnwatch.org
* cisco@spot.colorado.edu
* cisco-nsp@puck.nether.net
* full-disclosure@lists.grok.org.uk
* comp.dcom.sys.cisco@newsgate.cisco.com
Future updates of this advisory, if any, will be placed on Cisco's worldwide
website, but may or may not be actively announced on mailing lists or
newsgroups. Users concerned about this problem are encouraged to check the
above URL for any updates.
Revision History
================
+---------------------------------------+
| Revision | | Initial |
| 1.0 | 2007-June-11 | public |
| | | release. |
+---------------------------------------+
Cisco Security Procedures
=========================
Complete information on reporting security vulnerabilities in Cisco products,
obtaining assistance with security incidents, and registering to receive
security information from Cisco, is available on Cisco's worldwide website at
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html.
This includes instructions for press inquiries regarding Cisco security
notices. All Cisco security advisories are available at
http://www.cisco.com/go/psirt.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Darwin)
iD8DBQFGlQT58NUAbBmDaxQRAteLAJwJ6NlFCJMW42m/8yfV3kPT+HJQMQCfQAfv
hyrwS47cTP+F31HhXBssf2U=
=al4l
- -----END PGP SIGNATURE-----
_______________________________________________________________________
For additional information or assistance, please contact our
help desk by telephone.
You may send Not Protectively Marked information via e-mail
to infosec@cpni.gsi.gov.uk.
Office hours:
Mon - Fri: 09:00 - 16:30 hours
Tel: +44 (0) 870 487 0748 and follow the voice prompts
Fax: +44 (0) 870 487 0749
On-call duty officer outside office hours:
Tel: +44 (0) 870 487 0748 and follow the voice prompts
___________________________________________________________________________
CPNI wishes to acknowledge the contributions of Cisco
for the information contained in this advisory.
___________________________________________________________________________
This advisory contains information released by the original author. Some of
the information may have changed since it was released. If the issue affects
you, it may be prudent to retrieve the advisory from the site of the original
source to ensure that you receive the most current
information concerning that problem.
Reference to any specific commercial product, process, or service by trade
name, trademark manufacturer, or otherwise, does not constitute or imply its
endorsement, recommendation, or favouring by CPNI. The views and opinions of
authors expressed within this notice shall not be used for advertising or
product endorsement purposes.
CPNI shall not accept responsibility for any errors or omissions
contained within this advisory. In particular, they shall not be liable for
any loss or damage whatsoever, arising from or in connection with the usage of
information contained within this advisory.
CPNI is a member of the Forum of Incident Response and Security Teams (FIRST)
and has contacts with other international Incident Response Teams (IRTs) in
order to foster cooperation and coordination in incident prevention, to prompt
rapid reaction to incidents, and to promote
information sharing amongst its members and the community at large.
___________________________________________________________________________