From: SecuriTeam <support@securiteam.com.>
To: [email protected]
Date: 12 Jul 2007 17:04:00 +0200
Subject: [NEWS] Cisco Unified Communications Manager Overflow Vulnerabilities
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-Id: <20070712151758.BF6445825@mail.tyumen.ru.>
X-Virus-Scanned: antivirus-gw at tyumen.ru
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Cisco Unified Communications Manager Overflow Vulnerabilities
------------------------------------------------------------------------
SUMMARY
Cisco Unified Communications Manager (CUCM), formerly CallManager,
contains two overflow vulnerabilities that could allow a remote,
unauthenticated user to cause a denial of service (DoS) condition or
execute arbitrary code.
A workaround exists for one of the vulnerabilities.
DETAILS
Affected Products:
Note: Cisco Unified CallManager versions 4.2, 4.3, 5.1 and 6.0 have been
renamed as Cisco Unified Communications Manager. CUCM versions 3.3, 4.0,
4.1 and 5.0 retain the Cisco Unified CallManager name.
Vulnerable Products
These products are vulnerable:
* Cisco Unified CallManager 3.3 versions prior to 3.3(5)SR3
* Cisco Unified CallManager 4.1 versions prior to 4.1(3)SR5
* Cisco Unified CallManager 4.2 versions prior to 4.2(3)SR2
* Cisco Unified Communications Manager 4.3 versions prior to 4.3(1)SR1
* Cisco Unified CallManager 5.0 and Communications Manager 5.1 versions
prior to 5.1(2)
Administrators of systems running CUCM version 3.x and 4.x can determine
the software version by navigating to Help > About Cisco Unified
CallManager and selecting the Details button via the CUCM Administration
interface.
Administrators of systems running CUCM version 5.0 can determine the
software version by viewing the main page of the CUCM Administration
interface. The software version can also be determined by running the
command show version active via the Command Line Interface (CLI).
Products Confirmed Not Vulnerable
Cisco Unified Communications Manager version 6.0 and Cisco CallManager
Express are not affected by these vulnerabilities. No other Cisco products
are currently known to be affected by these vulnerabilities.
Details:
Cisco Unified Communications Manager (CUCM), formerly CallManager, is the
call processing component of the Cisco IP telephony solution that extends
enterprise telephony features and functions to packet telephony network
devices, such as IP phones, media processing devices, voice-over-IP (VoIP)
gateways, and multimedia applications.
* CTL Provider Service Overflow
The Certificate Trust List (CTL) Provider service of CUCM contains a heap
overflow vulnerability that could allow a remote, unauthenticated user to
cause a DoS condition or execute arbitrary code. The CTL Provider service
listens on TCP port 2444 by default, but the port is user-configurable.
This vulnerability is corrected in CUCM versions 4.1(3)SR5, 4.2(3)SR2,
4.3(1)SR1 and 5.1(2). CUCM 3.x versions are not affected by this
vulnerability. This issue is documented in Cisco Bug ID CSCsi03042.
* RIS Data Collector Heap Overflow
The Real-Time Information Server (RIS) Data Collector service of CUCM
contains a heap overflow vulnerability that could allow a remote,
unauthenticated user to cause a DoS condition or execute arbitrary code.
The RIS Data Collector process listens on TCP port 2556 by default, but
the port is user-configurable. This vulnerability is corrected in CUCM
versions 3.3(5)SR2b, 4.1(3)SR5, 4.2(3)SR2, 4.3(1)SR1 and 5.1(2). This
issue is documented in Cisco Bug ID CSCsi10509.
Impact:
Successful exploitation of these vulnerabilities may result in a DoS
condition or the execution of arbitrary code.
Workarounds:
It is possible to workaround the CTL Provider Service Overflow
vulnerability by disabling the CTL Provider Service if it is not needed.
Access to the CTL Provider Service is usually only required during the
initial configuration of CUCM authentication and encryption features. For
CUCM 4.x systems, please consult the following documentation for details
on how to disable CUCM services:
<http://www.cisco.com/en/US/products/sw/voicesw/ps556/products_administration_guide_chapter09186a008070ec49.html>; http://www.cisco.com/en/US/products/sw/voicesw/ps556/products_administration_guide_chapter09186a008070ec49.html
For CUCM 5.x systems, please consult the following documentation for
details on how to disable CUCM services:
<http://www.cisco.com/en/US/products/sw/voicesw/ps556/products_administration_guide_chapter09186a008037ced2.html#wp1048220> http://www.cisco.com/en/US/products/sw/voicesw/ps556/products_administration_guide_chapter09186a008037ced2.html#wp1048220
Filtering traffic to affected CUCM systems on screening devices can be
used as a mitigation technique for both vulnerabilities:
* Permit access to TCP port 2444 only between the CUCM systems where the
CTL Provider service is active and the CTL Client, usually on the
administrator's workstation, to mitigate the CTL Provider service
overflow.
* Permit access to TCP port 2556 only from other CUCM cluster systems to
mitigate the RIS Data Collector overflow.
It is possible to change the default ports of the CTL Provider (2444/TCP)
and RIS Data Collector (2556/TCP) services. If changed, filtering should
be based on the values used. The values of the ports can be viewed in CUCM
Administration interface by following the System > Service Parameters menu
and selecting the appropriate service.
There is currently no method to configure filtering directly on a CUCM
system.
Although it is often difficult to block traffic transiting your network,
it is possible to identify traffic that should never be allowed to target
your infrastructure devices and block that traffic at the border of your
network. Infrastructure ACLs are considered a network security best
practice and should be considered as a long-term addition to good network
security, as well as a workaround for this specific vulnerability. The
filters shown above should be included as part of an infrastructure access
list which will protect all devices with IP addresses in the
infrastructure IP address range.
The white paper entitled "Protecting Your Core: Infrastructure Protection
Access Control Lists" presents guidelines and recommended deployment
techniques for infrastructure protection access lists. This document is
available at the following link:
<http://www.cisco.com/en/US/tech/tk648/tk361/technologies_white_paper09186a00801a1a55.shtml>; http://www.cisco.com/en/US/tech/tk648/tk361/technologies_white_paper09186a00801a1a55.shtml
Filters blocking access to TCP/2444 and TCP/2556 should be deployed at the
network edge as part of a transit access list which will protect the
router where the ACL is configured, as well as other devices behind it.
Further information about transit ACLs is available in the white paper
"Transit Access Control Lists: Filtering at Your Edge," which is available
at the following link:
<http://www.cisco.com/en/US/tech/tk648/tk361/technologies_white_paper09186a00801afc76.shtml>; http://www.cisco.com/en/US/tech/tk648/tk361/technologies_white_paper09186a00801afc76.shtml
Additional mitigations that can be deployed on Cisco devices within the
network are available in the Cisco Applied Intelligence companion document
for this advisory:
<http://www.cisco.com/warp/public/707/cisco-air-20070711-cucm.shtml>;
http://www.cisco.com/warp/public/707/cisco-air-20070711-cucm.shtml
ADDITIONAL INFORMATION
The information has been provided by <mailto:psirt@cisco.com.> Cisco
Systems Product Security Incident Response Team.
The original article can be found at:
<http://www.cisco.com/warp/public/707/cisco-sa-20070711-cucm.shtml>;
http://www.cisco.com/warp/public/707/cisco-sa-20070711-cucm.shtml
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected]
In order to subscribe to the mailing list, simply forward this email to: [email protected]
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
