OSVDB ID: 36122 Title: Cisco Unified Communications Manager (CUCM) Certificate Trust List (CTL) Provider Service (CTLProvider.exe) Remote Overflow |
Info |
|
|
Dates |
||||
|
|
Description |
A heap overflow exists in CallManager and Communications Manager. The Certificate Trust List Provider Service fails to validate received packets resulting in a heap overflow. With a specially crafted packet, a remote attacker can cause arbitrary code execution resulting in a loss of integrity. |
Classification |
Location:
Remote / Network Access
Attack Type: Input Manipulation Impact: Loss of Integrity Exploit: Exploit Unknown Disclosure: OSVDB Verified |
Solution |
Upgrade to CallManager versions 4.1(3)SR5, 4.2(3)SR2 or higher, or Communications Manager versions 4.3(1)SR1, 5.1(2) or higher as they have been reported to fix this vulnerability. An upgrade is required as there are no known workarounds. |
Products |
|
References |
|
Credit |
Unknown or Incomplete |