CVE-2017-3792: Input Validation
A vulnerability in a proprietary device driver in the kernel of Cisco TelePresence Multipoint Control Unit (MCU) Software could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition. The vulnerability is due to improper size validation when reassembling fragmented IPv4 or IPv6 packets. An attacker could exploit this vulnerability by sending crafted IPv4 or IPv6 fragments to a port receiving content in Passthrough content mode. An exploit could allow the attacker to overflow a buffer. If successful, the attacker could execute arbitrary code or cause a DoS condition on the affected system. Cisco TelePresence MCU platforms TelePresence MCU 5300 Series, TelePresence MCU MSE 8510 and TelePresence MCU 4500 are affected when running software version 4.3(1.68) or later configured for Passthrough content mode. Cisco has released software updates that address this vulnerability. Workarounds that address this vulnerability are not available, but mitigations are available. Cisco Bug IDs: CSCuu67675.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cisco TelePresence MCU Softwareto a version that resolves this vulnerability.Fixed in 4.3(1.68) - Configuration
Disable Passthrough content mode (workarounds not available; only mitigations are available) on affected TelePresence MCU platforms to prevent exploitation via crafted IPv4/IPv6 fragments.
Cisco TelePresence MCU Software (Passthrough content mode) Passthrough content mode = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2017-3792?
CVE-2017-3792 has a high severity rating due to its potential for arbitrary code execution and denial of service.
How do I fix CVE-2017-3792?
To mitigate CVE-2017-3792, update to the latest version of Cisco TelePresence MCU Software that addresses this vulnerability.
What versions of Cisco TelePresence MCU Software are affected by CVE-2017-3792?
CVE-2017-3792 affects specific versions of Cisco TelePresence MCU Software from 4.3 to 4.5, including various subversions.
Can CVE-2017-3792 be exploited remotely?
Yes, CVE-2017-3792 can be exploited by an unauthenticated remote attacker.
What are the consequences of exploiting CVE-2017-3792?
Exploiting CVE-2017-3792 can lead to arbitrary code execution or a denial of service condition on the affected devices.