PatchAdvisor, Inc. www.patchadvisor.com PATCHADVISOR VULNERABILITY ALERT Cisco CallManager CTI Manager Remote Denial Of Service Vulnerability VULNERABILITY NAME ================== Cisco CallManager CTI Manager Remote Denial Of Service Vulnerability PUBLISHED DATE ============== 12-JUL-05 UPDATED DATE ============ 19-JUL-05 BACKGROUND ========== Cisco Call Manager (CCM) is the software-based call-processing component of the Cisco IP telephony solution which extends enterprise telephony features and functions to packet telephony network devices such as IP phones, media processing devices, voice-over-IP (VoIP) gateways, and multimedia applications. More information about the product is available here: http://www.cisco.com/en/US/products/sw/voicesw/ps556/index.html DESCRIPTION =========== Cisco Call Manager may restart when more than 1GB of memory is used. Sending specially crafted packets to the CCM will cause the CCM to use more than 1 gigabyte of virtual memory. An example of how to send a specially crafted packet is: wget http://victim:2000 Cisco has allocated CSCee00116 for this vulnerability. Their bulletin is available here: http://www.cisco.com/warp/public/707/cisco-sa-20050712-ccm.shtml IMPACT ====== Successful exploitation of the vulnerability may result in resource starvation resulting in high CPU utilization, unresponsive terminal services, the inability to run CCM Admin or to map drives. This may subsequently lead to phones not responding, phones unregistering from the Cisco CallManager, or Cisco CallManager restarting. In extreme examples, all VoIP phones may restart after only 1 packet being sent to the CCM. VERSIONS AFFECTED ================= Cisco CallManager 3.2 and earlier Cisco CallManager 3.3, versions earlier than 3.3(5) Cisco CallManager 4.0, versions earlier than 4.0(2a)SR2b Cisco CallManager 4.1, versions earlier than 4.1(3)SR1 SOLUTION ======== Upgrade to version Call Manager 3.3(5) or 4.1(4) Vulnerability History ===================== 21 April 2005 Identified by Jeff Fay of PatchAdvisor 21 April 2005 Issue disclosed to Cisco 25 April 2005 Vulnerability confirmed Cisco 12 July 2005 Cisco Public Disclosure UPDATES ======= Further updates to this notice will be posted to the PatchAdvisor site http://www.patchadvisor.com CREDIT ====== Jeff Fay of PatchAdvisor (Jeff@patchadvisor.com) ABOUT PATCHADVISOR ================== PatchAdvisor, Inc. was founded in 2003 and is based in Alexandria, Virginia with offices in Maryland and Florida. Our corporate philosophy is simple, we empower clients with the knowledge and tools they need to secure their environment. Our products and services go beyond the rest by providing not only an understanding of security issues, but also providing lasting solutions tailored for each unique environment so clients can quickly focus on the task of securing their environment. Request a free trial of our vulnerability alerting solution by clicking here: http://www.patchadvisor.com/Products/Default.aspx DISCLAIMER ========== This information is provided in an AS IS condition and may change without notice. There are no warranties with regard to this information. Neither PatchAdvisor nor the author are liable for any consequences arising from either following or not following this information. Copyright 2005 PatchAdvisor Inc. All rights reserved. www.patchadvisor.com