Security Intelligence Operations

Cisco IOS Software and Cisco Unified Communications Manager Session Initiation Protocol Message Processing Denial of Service Vulnerabilities

Vulnerability Alert	Powered by

Threat Type:

Unintended Weakness: Denial of Service

IntelliShield ID:	16660
Version:	1
First Published:	September 24, 2008 03:44 PM EDT
Last Published:	September 24, 2008 03:44 PM EDT
Vector:	Network
Authentication:	None
Exploit:	Functional
Port:	Not Available
CVE:	CVE-2008-3800 , CVE-2008-3801 , CVE-2008-3802
BugTraq ID:	31361 , 31367

Urgency:	Unlikely Use
Credibility:	Confirmed
Severity:	Mild Damage
CVSS Base:	7.8	CVSS Calculator CVSS Version 2
CVSS Temporal:	6.4	CVSS Calculator CVSS Version 2


Version Summary:	Cisco IOS software and Cisco Unified Communications Manager contain vulnerabilities when processing Session Initiation Protocol messages that could allow an unauthenticated, remote attacker to cause a denial of service condition. Updated software is available.

Description

Cisco IOS Software and Cisco Unified Communications Manager contain vulnerabilities that could allow an unauthenticated, remote attacker to cause the device to reload.

The vulnerabilities exist in the Session Initiation Protocol (SIP) when handling SIP messages. An attacker could exploit the vulnerabilities by sending a malicious SIP message to the affected device. Due to an error, the device fails to properly handle the message and reloads. Repeated attacks could result in a persistent denial of service (DoS) condition.

Cisco has confirmed these vulnerabilities and released updated software.

Warning Indicators

A complete list of affected Cisco IOS devices is available in the following advisory: cisco-sa-20080924-sip. In addition, the following Cisco Unified Communications Manager versions are vulnerable to CVE-2008-3801:

Cisco Unified Communications Manager prior to 6.1(2)SU1
Cisco Unified Communications Manager prior to 5.1(3d)
Cisco Unified Communications Manager prior to 4.3(2)SR1a
Cisco Unified Communications Manager prior to 4.2(3)SR4b
Cisco Unified Communications Manager prior to 4.1.3SR8

IntelliShield Analysis

A device that is running an affected Cisco IOS Software version must have SIP voice services enabled to be vulnerable. An exploit could allow the attacker to cause the affected device to reload. Repeated attacks may result in a persistent DoS condition.

Only Cisco IOS Software is vulnerable to the DoS vulnerability associated with CVE-2008-3802. Both Cisco IOS devices and Cisco Unified Communications Manager systems are affected by the vulnerabilities associated with CVE-2008-3800 and CVE-2008-3801. However, accomplishing a successful exploit using the CVE-2008-3801 vulnerability against Cisco Unified Communications Manager systems is considerably more complex. IntelliShield has published alert 16667 to describe the requirements for a successful attack against a Cisco Unified Communications Manager system.

Cisco indicated through CVSS scoring the existence of functional exploit code; however, this exploit code is not known to be publicly available.

Versions of Cisco Unified CallManager after 4.1 have been renamed Cisco Unified Communications Manager.

Vendor Announcements

Cisco has released security advisories for Cisco Bug IDs CSCsg91306, CSCsl62609, CSCsm46064 and CSCsk42759 at the following links: cisco-sa-20080924-sip and cisco-sa-20080924-cucm

Impact

An unauthenticated, remote attacker could exploit the vulnerabilities to cause the affected device to reload, which may result in a DoS condition.

Technical Information

The vulnerabilities exist due to improper handling of malformed SIP messages that are sent to an affected device. An unauthenticated, remote attacker could exploit the vulnerabilities by sending a malicious SIP message to an affected system. When the message is processed, the system fails to properly handle the request. An exploit could cause the device to reload. Repeated attacks against the system may result in a persistent DoS condition.

Safeguards

Administrators are advised to apply the appropriate update.

Administrators are advised to restrict network access to affected systems to trusted systems or networks.

Administrators are advised to monitor critical systems for signs of suspicious activity.

The Cisco Applied Intelligence team has created the following companion document to guide administrators in identifying and mitigating attempts to exploit this vulnerability prior to applying updated software: cisco-amb-20080924-sip

Patches/Software

Cisco customers with active contracts can obtain updates through the Software Center at the following link: Cisco. Cisco customers without contracts can obtain upgrades by contacting the Cisco Technical Assistance Center at 1-800-553-2447 or 1-408-526-7209, or via e-mail at tac@cisco.com.

Alert History

Initial Release

Product Sets

The security vulnerability applies to the following combinations of products.

Primary Products:
Cisco	Cisco CallManager	4.1 Base \| 4.1(2) Base \| 4.1(2)ES33 Base \| 4.1(2)ES50 Base \| 4.1(2)SR1 Base \| 4.1(3) Base \| 4.1(3)2 Base \| 4.1(3)SR Base \| 4.1(3)SR1 Base \| 4.1(3)SR2 Base \| 4.1(3)SR3 Base \| 4.1(3)SR3b Base \| 4.1(3)SR3c Base \| 4.1(3)SR4 Base \| 4.1(3)SR4b Base \| 4.1(3)SR4d Base \| 4.1(3)SR5 Base \| 4.2(1.02) Base \| 4.2(1.05.3) Base \| 4.2(1.06) Base \| 4.2(1.07) Base \| 4.2(1) Base \| 4.2(1)SR1b Base \| 4.2(3) Base \| 4.2(3)SR1 Base \| 4.2(3)SR2 Base \| 4.3 Base \| 4.3(1.57) Base \| 4.3(1) Base \| 4.3(1)SR Base \| 4.3(1)SR1 Base \| 4.3(1)SR1a Base \| 4.3(1)SR1b Base \| 5.0(1) Base \| 5.0(2) Base \| 5.0(2a) Base \| 5.0(3.1101) Base \| 5.0(3) Base \| 5.0(3a) Base \| 5.0(4.2136.001) Base \| 5.0(4.2137.001) Base \| 5.0(4.2137.002) Base \| 5.0(4) Base \| 5.0(4a) Base \| 5.0(4a)SU1 Base \| 5.0(4c) Base \| 5.1 Base \| 5.1(1.9131.045) Base \| 5.1(1) Base \| 5.1(1a) Base \| 5.1(1b) Base \| 5.1(1c) Base \| 5.1(2) Base \| 5.1(2a) Base \| 5.1(2b) Base \| 5.1(3) Base \| 5.1(3a) Base \| 5.1(3b) Base \| 5.1(3c) Base \| 6.0(0.9901.169) Base \| 6.0(0.9901.190) Base \| 6.0(1) Base \| 6.0(1a) Base \| 6.0(1b) Base \| 6.1 Base \| 6.1(1) Base \| 6.1(1a) Base \| 6.1(2) Base
Cisco	Cisco Unified CallManager	5.0 (1), (2), (2a), (3), (3.1101), (3a), (4), (4a), (4a)SU1 \| 5.1 Base
Cisco	IOS	12.2B Base \| 12.2BX Base \| 12.2BY Base \| 12.2CZ Base \| 12.2MC Base \| 12.2T Base \| 12.2tpc Base \| 12.2XB Base \| 12.2XM Base \| 12.2XT Base \| 12.2XU Base \| 12.2XW Base \| 12.2YA Base \| 12.2YB Base \| 12.2YC Base \| 12.2YD Base \| 12.2YF Base \| 12.2YH Base \| 12.2YJ Base \| 12.2YL Base \| 12.2YM Base \| 12.2YN Base \| 12.2YT Base \| 12.2YU Base \| 12.2YV Base \| 12.2YW Base \| 12.2YY Base \| 12.2ZB Base \| 12.2ZC Base \| 12.2ZD Base \| 12.2ZE Base \| 12.2ZF Base \| 12.2ZH Base \| 12.2ZJ Base \| 12.2ZL Base \| 12.2ZP Base \| 12.3 Base, T \| 12.3B Base \| 12.3T Base \| 12.3TPC Base \| 12.3VA Base \| 12.3XA Base \| 12.3XB Base \| 12.3XC Base \| 12.3XD Base \| 12.3XE Base \| 12.3XF Base \| 12.3XG Base \| 12.3XI Base \| 12.3XJ Base \| 12.3XK Base \| 12.3XL Base \| 12.3XQ Base \| 12.3XR Base \| 12.3XU Base \| 12.3XW Base \| 12.3XX Base \| 12.3XY Base \| 12.3XZ Base \| 12.3YF Base \| 12.3YG Base \| 12.3YK Base \| 12.3YM Base \| 12.3YQ Base \| 12.3YS Base \| 12.3YT Base \| 12.3YU Base \| 12.3YX Base \| 12.3YZ Base \| 12.3ZA Base \| 12.4 Base \| 12.4MR Base \| 12.4T Base \| 12.4XA Base \| 12.4XB Base \| 12.4XC Base \| 12.4XD Base \| 12.4XE Base \| 12.4XJ Base \| 12.4XL Base \| 12.4XP Base \| 12.4XT Base \| 12.4XV Base \| 12.4XW Base \| 12.4XY Base

Associated Products:
N/A

LEGAL DISCLAIMER
The urgency and severity ratings of this alert are not tailored to individual users; users may value alerts differently based upon their network configurations and circumstances. THE ALERT, AND INFORMATION CONTAINED THEREIN, ARE PROVIDED ON AN "AS IS" BASIS AND DO NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE ALERT, AND INFORMATION CONTAINED THEREIN, OR MATERIALS LINKED FROM THE ALERT, IS AT YOUR OWN RISK. INFORMATION IN THIS ALERT AND ANY RELATED COMMUNICATIONS IS BASED ON OUR KNOWLEDGE AT THE TIME OF PUBLICATION AND IS SUBJECT TO CHANGE WITHOUT NOTICE. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE ALERTS AT ANY TIME.

Hierarchical Navigation

Security Intelligence Operations

Related Links

Feedback