Most recent entries from all

CERTA-2010-AVI-408 — Deux vulnérabilités dans Cisco Unified Presence permettent à une personne distante malintentionnée de provoquer un déni…

CERTA-2010-AVI-408

fkie_cve-2010-2840

GHSA-8q52-6xmp-rvx5

gsd-2010-2840

VAR-201008-0146

The Presence Engine (PE) service in Cisco Unified Presence 6.x before 6.0(7) and 7.x before 7.0(8) does not properly handle an erroneous Contact field in the header of a SIP SUBSCRIBE message, which allows remote attackers to cause a denial of service (process failure) via a malformed message, aka Bug ID CSCtd39629. Cisco Unified Presence is prone to a denial-of-service vulnerability. An attacker can exploit this issue to cause a disruption in presence services, denying service to legitimate users. This issue is being tracked by Cisco BugID CSCtd39629. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

Cisco Security Advisory: Cisco Unified Presence Denial of Service Vulnerabilities

Advisory ID: cisco-sa-20100825-cup

Revision 1.0

For Public Release 2010 August 25 1600 UTC (GMT)

+---------------------------------------------------------------------

Summary =======

Cisco Unified Presence contains two denial of service (DoS) vulnerabilities that affect the processing of Session Initiation Protocol (SIP) messages.

Cisco has released free software updates that address these vulnerabilities. There are no workarounds for these vulnerabilities.

This advisory is posted at:

http://www.cisco.com/warp/public/707/cisco-sa-20100825-cup.shtml

Affected Products =================

Vulnerable Products +------------------

The following products are affected:

* Cisco Unified Presence 6.0 versions prior to 6.0(7) * Cisco Unified Presence 7.0 versions prior to 7.0(8)

Note: Cisco…