Cisco patches serious vulnerabilities in Unified Communications Manager

The vulnerabilities can be exploited by attackers to execute arbitrary commands or disrupt telephony-related services, Cisco said

Cisco Systems has released new security patches for several versions of Unified Communications Manager (UCM) to address vulnerabilities that could allow remote attackers to execute arbitrary commands, modify system data or disrupt services.

The UCM is the call processing component of Cisco's IP Telephony solution. It connects to IP (Internet Protocol) phones, media processing devices, VoIP gateways, and multimedia applications and provides services such as session management, voice, video, messaging, mobility, and web conferencing.

The most serious vulnerability addressed by the newly released patches can lead to a buffer overflow and is identified as CVE-2013-3462 in the Common Vulnerabilities and Exposures database. This vulnerability can be exploited remotely, but it requires the attacker to be authenticated on the device.

"An attacker could exploit this vulnerability by overwriting an allocated memory buffer on an affected device," Cisco said Wednesday in a security advisory. "An exploit could allow the attacker to corrupt data, disrupt services, or run arbitrary commands."

The CVE-2013-3462 vulnerability affects versions 7.1(x), 8.5(x), 8.6(x), 9.0(x) and 9.1(x) of Cisco UCM, Cisco said.

The company also patched three denial-of-service (DoS) flaws that can be remotely exploited by unauthenticated attackers.

One of them, identified as CVE-2013-3459, is caused by improper error handling and can be exploited by sending malformed registration messages to the affected devices. The flaw only affects Cisco UCM 7.1(x) versions.

The second DoS issue is identified as CVE-2013-3460 and is caused by insufficient limiting of traffic received on certain UDP ports. It can be exploited by sending UDP packets at a high rate on those specific ports to devices running versions 8.5(x), 8.6(x), and 9.0(x) of Cisco UCM.

The third vulnerability, identified as CVE-2013-3461, is similar but only affects the Session Initiation Protocol (SIP) port. "An attacker could exploit this vulnerability by sending UDP packets at a high rate to port 5060 on an affected device," Cisco said. The vulnerability affects Cisco UCM versions 8.5(x), 8.6(x) and 9.0(1).

Patched versions have been released for all UCM release branches affected by these vulnerabilities and there are no known workarounds at the time that would mitigate the flaws without upgrading.

All of the patched vulnerabilities were discovered during internal testing and the company's product security incident response team (PSIRT) is not aware of any cases where these issues have been exploited or publicly documented.

"In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release," Cisco said. "If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers."

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags patchestelephonyunified communicationsCisco SystemstelecommunicationNetworkingsecuritypatch managementExploits / vulnerabilities

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?