cisco-sa-20190206-meeting-sipdos: Cisco Meeting Server SIP Processing Denial of Service Vulnerability
First published: Wed Feb 06 2019(Updated: )
A vulnerability in the Session Initiation Protocol (SIP) call processing of Cisco Meeting Server (CMS) software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition of the Cisco Meeting Server. The vulnerability is due to insufficient validation of Session Description Protocol (SDP) messages. An attacker could exploit this vulnerability by sending a crafted SDP message to the CMS call bridge. An exploit could allow the attacker to cause the CMS to reload, causing a DoS condition for all connected clients. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
Credit: This vulnerability was found during the resolution a Cisco TAC support case
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Webex Meetings Server |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of cisco-sa-20190206-meeting-sipdos?
The severity of cisco-sa-20190206-meeting-sipdos is classified as high due to the potential for denial of service conditions.
How do I fix cisco-sa-20190206-meeting-sipdos?
To fix cisco-sa-20190206-meeting-sipdos, upgrade to a version of Cisco Meeting Server that is not affected by the vulnerability.
Who is affected by cisco-sa-20190206-meeting-sipdos?
Cisco Meeting Server installations that handle SIP call processing are affected by cisco-sa-20190206-meeting-sipdos.
What type of attack does cisco-sa-20190206-meeting-sipdos allow?
cisco-sa-20190206-meeting-sipdos allows an unauthenticated remote attacker to cause a denial of service.
What causes the cisco-sa-20190206-meeting-sipdos vulnerability?
The cisco-sa-20190206-meeting-sipdos vulnerability is caused by insufficient validation in the Session Initiation Protocol (SIP) call processing.
- agent/type
- agent/event
- agent/last-modified-date
- agent/first-publish-date
- collector/cisco-advisory
- source/Cisco
- agent/references
- agent/weakness
- agent/severity
- agent/title
- agent/author
- agent/description
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco webex meetings server