CVE-2008-0027: Buffer Overflow

Published Jan 17, 2008

Updated

Heap-based buffer overflow in the Certificate Trust List (CTL) Provider service (CTLProvider.exe) in Cisco Unified Communications Manager (CUCM) 4.2 before 4.2(3)SR3 and 4.3 before 4.3(1)SR1, and CallManager 4.0 and 4.1 before 4.1(3)SR5c, allows remote attackers to cause a denial of service or execute arbitrary code via a long request.

Affected Software

9 affected components

Cisco Unified Communications Manager=4.2.3sr2

Cisco Unified Communications Manager=4.2

Cisco Unified Communications Manager=4.3

Cisco Unified CallManager=4.1

Cisco Unified CallManager=4.1\(3\)sr5

Cisco Unified CallManager=4.1\(3\)sr4

Cisco Unified CallManager=4.1\(3\)sr5b

Cisco Unified Communications Manager=4.2.3sr2b

Cisco Unified CallManager=4.0

Remediation

Patch Available

http://www.cisco.com/en/US/products/products_security_advisory09186a0080932c61.shtml

Event History

Jan 17, 2008

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2008-0027?

CVE-2008-0027 has a high severity rating due to its potential to cause denial of service and remote code execution.

How do I fix CVE-2008-0027?

To fix CVE-2008-0027, upgrade your Cisco Unified Communications Manager to the patched versions: 4.2(3)SR3 or 4.3(1)SR1.

What versions of Cisco Unified Communications Manager are affected by CVE-2008-0027?

CVE-2008-0027 affects Cisco Unified Communications Manager versions 4.0, 4.1, and 4.2 prior to specific patch releases.

What is the exploit vector for CVE-2008-0027?

The exploit vector for CVE-2008-0027 is remote attackers targeting the Certificate Trust List Provider service.

What impact does CVE-2008-0027 have on my system?

CVE-2008-0027 can lead to a denial of service, allowing attackers to crash the service or potentially execute arbitrary code.