CVE-2010-0591: High severity Cisco Unified Communications Manager vulnerability

Published Mar 5, 2010

Updated

Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 6.x before 6.1(5), 7.x before 7.1(3b)SU2, and 8.x before 8.0(1) allows remote attackers to cause a denial of service (process failure) via a malformed SIP REG message, related to an overflow of the Telephone-URL field, aka Bug ID CSCtc62362.

Affected Software

18 affected components

Cisco Unified Communications Manager=6.0

Cisco Unified Communications Manager=6.0\(1\)

Cisco Unified Communications Manager=6.0\(1a\)

Cisco Unified Communications Manager=6.1

Cisco Unified Communications Manager=6.1\(1\)

Cisco Unified Communications Manager=6.1\(1a\)

Cisco Unified Communications Manager=6.1\(1b\)

Cisco Unified Communications Manager=6.1\(2\)

Cisco Unified Communications Manager=6.1\(2\)su1

Cisco Unified Communications Manager=6.1\(2\)su1a

Cisco Unified Communications Manager=6.1\(3\)

Cisco Unified Communications Manager=6.1\(4\)

Cisco Unified Communications Manager=6.1.0

Cisco Unified Communications Manager=7.0

Cisco Unified Communications Manager=7.0\(1\)

Cisco Unified Communications Manager=7.0\(2\)

Cisco Unified Communications Manager=7.1

Cisco Unified Communications Manager=8.0

Remediation

Patch Available

http://www.cisco.com/en/US/products/products_security_advisory09186a0080b1b924.shtml

Event History

Mar 5, 2010

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Data Sourced

via NVD·04:30 PM

RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2010-0591?

CVE-2010-0591 is classified as a denial of service vulnerability.

How do I fix CVE-2010-0591?

To fix CVE-2010-0591, upgrade to a version of Cisco Unified Communications Manager that is not affected, such as 6.1(5) or later.

Which versions of Cisco Unified Communications Manager are affected by CVE-2010-0591?

CVE-2010-0591 affects Cisco Unified Communications Manager versions 6.x before 6.1(5), 7.x before 7.1(3b)SU2, and 8.x before 8.0(1).

What is the impact of CVE-2010-0591?

The impact of CVE-2010-0591 is that it allows remote attackers to cause a denial of service via a malformed SIP REG message.

Is CVE-2010-0591 exploitable remotely?

Yes, CVE-2010-0591 is exploitable remotely, allowing attackers to trigger process failures.