CVE-2017-12311: Input Validation
First published: Thu Nov 16 2017(Updated: )
A vulnerability in the H.264 decoder function of Cisco Meeting Server could allow an unauthenticated, remote attacker to cause a Cisco Meeting Server media process to restart unexpectedly when it receives an illegal H.264 frame. The vulnerability is triggered by an H.264 frame that has an invalid picture parameter set (PPS) value. An attacker could exploit this vulnerability by sending a malformed H.264 frame to the targeted device. An exploit could allow the attacker to cause a denial of service (DoS) condition because the media process could restart. The media session should be re-established within a few seconds, during which there could be a brief interruption in service. Cisco Bug IDs: CSCvg12559.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Meeting Server | =2.0 | |
| Cisco Meeting Server | =2.1.0 | |
| Cisco Meeting Server | =2.2.0 | |
| Cisco Meeting Server | =2.3.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2017-12311?
CVE-2017-12311 is a vulnerability in the H.264 decoder function of Cisco Meeting Server that could allow an unauthenticated attacker to cause a media process to restart unexpectedly.
How does CVE-2017-12311 get triggered?
CVE-2017-12311 is triggered by an H.264 frame that has an invalid pi.
What is the severity of CVE-2017-12311?
CVE-2017-12311 has a severity rating of medium.
Which version of Cisco Meeting Server is affected by CVE-2017-12311?
CVE-2017-12311 affects Cisco Meeting Server versions 2.0, 2.1.0, 2.2.0, and 2.3.0.
How can I find more information about CVE-2017-12311?
You can find more information about CVE-2017-12311 in the following references: [1] SecurityFocus, [2] SecurityTracker, and [3] Cisco Security Advisory.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/references
- agent/last-modified-date
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- agent/trending
- agent/tags
- agent/source
- vendor/cisco
- canonical/cisco meeting server
- version/cisco meeting server/2.0
- version/cisco meeting server/2.1.0
- version/cisco meeting server/2.2.0
- version/cisco meeting server/2.3.0