CVE-2019-1676: Cisco Meeting Server SIP Processing Denial of Service Vulnerability
First published: Fri Feb 08 2019(Updated: )
A vulnerability in the Session Initiation Protocol (SIP) call processing of Cisco Meeting Server (CMS) software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition of the Cisco Meeting Server. The vulnerability is due to insufficient validation of Session Description Protocol (SDP) messages. An attacker could exploit this vulnerability by sending a crafted SDP message to the CMS call bridge. An exploit could allow the attacker to cause the CMS to reload, causing a DoS condition for all connected clients. Versions prior to 2.3.9 are affected.
Credit: ykramarz@cisco.com ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Meeting Server | >=2.3.0<2.3.9 | |
| >=2.3.0<2.3.9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-1676?
CVE-2019-1676 is a vulnerability in the Session Initiation Protocol (SIP) call processing of Cisco Meeting Server (CMS) software that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition.
How does CVE-2019-1676 affect Cisco Meeting Server?
CVE-2019-1676 affects Cisco Meeting Server by causing a denial of service (DoS) condition.
What is the severity of CVE-2019-1676?
CVE-2019-1676 has a severity rating of high, with a CVSS score of 7.5.
How can the CVE-2019-1676 vulnerability be exploited?
The CVE-2019-1676 vulnerability can be exploited by an unauthenticated, remote attacker through the Session Initiation Protocol (SIP) call processing of Cisco Meeting Server (CMS) software.
Is there a fix for CVE-2019-1676?
Yes, Cisco has released a security advisory with details on how to mitigate the CVE-2019-1676 vulnerability.
- collector/nvd-index
- agent/references
- agent/type
- agent/title
- agent/weakness
- agent/severity
- agent/description
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/author
- agent/softwarecombine
- agent/event
- agent/tags
- agent/source
- vendor/cisco
- canonical/cisco meeting server
- version/cisco meeting server/2.3.0