Summary

• Cisco Unified Communications Manager, which was formerly Cisco Unified CallManager, contains a denial of service (DoS) vulnerability in the Session Initiation Protocol (SIP) service. An exploit of this vulnerability may cause an interruption in voice services.

  Cisco has released software updates that address this vulnerability. There are no workarounds for this vulnerability.

  This advisory is posted at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20090923-cm.

  Note: Cisco IOS^® Software is also affected by the vulnerability described in this advisory. A companion advisory for Cisco IOS software is available at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20090923-sip.

  Note: The September 23, 2009, Cisco IOS Security Advisory bundled publication includes eleven Security Advisories. Ten of the advisories address vulnerabilities in Cisco IOS Software, and one advisory addresses a vulnerability in Cisco Unified Communications Manager. Each advisory lists the releases that correct the vulnerability or vulnerabilities detailed in the advisory.

  Individual publication links are in "Cisco Event Response: Semiannual Cisco IOS Software Advisory Bundled Publication" at the following link:

  http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_ sep09.html

Affected Products

• The vulnerability described in this document applies to the Cisco Unified Communications Manager.

  Vulnerable Products

  The following Cisco Unified Communications Manager versions are affected:

  • Cisco Unified Communications Manager 5.x versions prior to 5.1(3g)
    
  • Cisco Unified Communications Manager 6.x versions prior to 6.1(4)
    
  • Cisco Unified Communications Manager 7.0.x versions prior to 7.0(2a)su1
    
  • Cisco Unified Communications Manager 7.1.x versions prior to 7.1(2)
    

  Cisco Unified CallManager versions 4.x are not affected by this vulnerability. Administrators of systems that are running Cisco Unified Communications Manager versions 5.x, 6.x and 7.x can determine the software version by viewing the main page of the Cisco Unified Communications Manager Administration interface. The software version can also be determined by running the show version active command via the command-line interface.

  A SIP trunk must be configured for the Cisco Unified CallManager server to begin listening for SIP messages on TCP and UDP port 5060 and TCP/5061. However, in Cisco Unified Communications Manager versions 5.x and later, the use of SIP as a call signaling protocol is enabled by default and cannot be disabled.

  Cisco IOS Software is also affected by this vulnerability, but it is associated with different Cisco bug IDs. A companion security advisory for Cisco IOS Software is available at: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20090923-sip

  Products Confirmed Not Vulnerable

  Cisco Unified CallManager versions 4.x are not affected by this vulnerability. With the exception of Cisco IOS software, no other Cisco products are currently known to be affected by this vulnerability.

Details

• Cisco Unified Communications Manager is the call processing component of the Cisco IP Telephony solution that extends enterprise telephony features and functions to packet telephony network devices, such as IP phones, media processing devices, voice-over-IP gateways, and multimedia applications.

  SIP is a popular signaling protocol that manages voice and video calls across IP networks such as the Internet. SIP is responsible for handling all aspects of call setup and termination. Voice and video are the most popular types of sessions that SIP handles, but the protocol is flexible enough to accommodate other applications that require call setup and termination. SIP call signaling can use UDP (port 5060), TCP (port 5060), or Transport Layer Security (TLS; TCP port 5061) as the underlying transport protocol.

  A DoS vulnerability exists in the SIP implementation of the Cisco Unified Communications Manager. This vulnerability could be triggered when Cisco Unified Communications Manager processes crafted SIP messages. An exploit could lead to a reload of the main Cisco Unified Communications Manager process.

  This vulnerability is documented in Cisco bug ID CSCsz95423 ( registered customers only) and has been assigned Common Vulnerabilities and Exposures (CVE) ID CVE-2009-2864.

Workarounds

• There are no workarounds for this vulnerability.

  It is possible to mitigate this vulnerability by implementing filtering on screening devices and permitting TCP/UDP access to ports 5060 and TCP/5061 only from networks that require SIP access to Cisco Unified Communications Manager servers.

  If Cisco Unified Communications Manager does not need to provide SIP services, administrators can configure the Cisco Unified Communications Manager to listen for SIP messages on non standard ports. Use the following instructions to change the ports from their default values:

  Step 1 Log into the Cisco Unified CallManager Administration web interface.

  Step 2 Navigate to System > Cisco Unified CM and locate the appropriate Cisco Unified Communications Manager.

  Step 3 Change the fields SIP Phone Port and SIP Phone Secure Port fields to a non standard port and click Save.

  SIP Phone Port, which is 5060 by default, refers to the TCP and UDP ports where the Cisco Unified Communications Manager listens for normal SIP messages, and SIP Phone Secure Port, by default 5061, refers to the TCP port where the Cisco Unified Communications Manager listens for SIP over TLS messages. For additional information about this procedure, refer to the "Updating a Cisco Unified Communications Manager" section of the "Cisco Unified Communications Manager Administration Guide" at http://www.cisco.com/en/US/docs/voice_ip_comm/cucmbe/admin/7_0_1/ccmcfg/b02ccm.html#wp1057513.

  Note: For a SIP port change to take effect, the Cisco CallManager Service must be restarted. For information on how to restart the service, refer to the "Restarting the Cisco CallManager Service" section of the document at http://www.cisco.com/en/US/docs/voice_ip_comm/cucmbe/admin/7_0_1/ccmcfg/b03dpi.html#wp1075124.

  Additional mitigations that can be deployed on Cisco devices in the network are available in the companion document "Cisco Applied Mitigation Bulletin: Identifying and Mitigating Exploitation of the Denial of Service Vulnerabilities in Cisco Unified Communications Manager and Cisco IOS Software", which is available at the following location: https://sec.cloudapps.cisco.com/security/center/content/CiscoAppliedMitigationBulletin/cisco-amb-20090923-voice.

Fixed Software

• When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution.

  In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center (TAC) or your contracted maintenance provider for assistance.

  The following table contains the first fixed software release for this vulnerability. A device running a version of the given release in a specific row (less than the First Fixed Release) is known to be vulnerable.

  Release	First Fixed Version
  4.x	Not Vulnerable
  5.x	5.1(3g)
  6.x	6.1(4)
  7.0.x	7.0(2a)su1
  7.1.x	7.1(2)

Exploitation and Public Announcements

• The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory.

  This vulnerability was discovered during internal testing.

URL

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20090923-cm

Revision History

• Revision 1.0

  2009-September-23

  Initial public release

  Show Less