Summary

• Cisco Unified Communications Manager (CUCM), formerly CallManager, and Cisco Unified Presence Server (CUPS) contain two vulnerabilities that could allow an unauthorized administrator to activate and terminate CUCM / CUPS system services and access SNMP configuration information. This may respectively result in a denial of service (DoS) condition affecting CUCM/CUPS cluster systems and the disclosure of sensitive SNMP details, including community strings.

  There are no workarounds for these vulnerabilities.

  Cisco has made free software available to address these vulnerabilities for affected customers.

  This advisory is posted at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20070711-voip.

Affected Products

• Note: Cisco Unified CallManager versions 4.2, 4.3, 5.1 and 6.0 have been renamed as Cisco Unified Communications Manager. CUCM versions 3.3, 4.0, 4.1 and 5.0 retain the Cisco Unified CallManager name.

  Vulnerable Products

  These products are vulnerable:

  • Cisco Unified CallManager 5.0 and Communications Manager 5.1 versions up to and including 5.1(2)
    
  • Cisco Unified Presence Server 1.0 versions up to and including 1.0(3)
    

  Administrators of systems running CUCM version 5.x and CUPS version 1.x can determine the software version by viewing the main page of the CUCM/CUPS Administration interface. The software version can also be determined by running the command show version active via the Command Line Interface (CLI).

  Products Confirmed Not Vulnerable

  • Cisco Unified CallManager versions 3.3, 4.0, 4.1, 4.2
    
  • Cisco Unified Communications Manager versions 4.3, 6.0
    
  • Cisco Unified Presence Server version 6.0
    

  No other Cisco products are currently known to be affected by these vulnerabilities.

Details

• • Unauthorized Administrator Can Activate/Terminate CUCM/CUPS System Services
    An unauthorized CUCM/CUPS administrator may be able to activate and terminate system services in a CUCM/CUPS cluster environment. This may result in a denial of critical voice services. The unauthorized administrator cannot make changes to or view the configuration of the vulnerable CUCM/CUPS system, with the exception of viewing SNMP settings, which is documented in the next vulnerability. The CUCM issue is documented by Cisco Bug ID CSCsj09859. The CUPS issue is documented by Cisco Bug ID CSCsj19985.
    
  • Unauthorized Administrator Can View CUCM/CUPS SNMP Settings
    An unauthorized CUCM/CUPS administrator may be able to view sensitive SNMP configuration information in a CUCM/CUPS cluster environment. This may result in the disclosure of sensitive information, including SNMP community strings. The CUCM issue is documented in Cisco Bug ID CSCsj20668. The CUPS issue is documented in Cisco Bug ID CSCsj25962.
    

  Vulnerability Scoring Details

  Cisco is providing scores for the vulnerabilities in this advisory based on the Common Vulnerability Scoring System (CVSS). The CVSS scoring in this Security Advisory is done in accordance with CVSS version 1.0.

  Cisco will provide a base and temporal score. Customers can then compute environmental scores to assist in determining the impact of the vulnerability in individual networks.

  Cisco PSIRT will set the bias in all cases to normal. Customers are encouraged to apply the bias parameter when determining the environmental impact of a particular vulnerability.

  CVSS is a standards based scoring method that conveys vulnerability severity and helps determine urgency and priority of response.

  Cisco has provided an FAQ to answer additional questions regarding CVSS at

  http://www.cisco.com/web/about/security/intelligence/cvss-qandas.html .

  Cisco has also provided a CVSS calculator to help compute the environmental impact for individual networks at

  https://sec.cloudapps.cisco.com/security/center/cvssCalculator.x.

  CSCsj09859 ( registered customers only) - Unauthorized administrators can start/stop CUCM services Calculate the environmental score of CSCsj09859
  CVSS Base Score - 7
  Access Vector	Access Complexity	Authentication	Confidentiality Impact	Integrity Impact	Availability Impact	Impact Bias
  Remote	Low	Not Required	Partial	Partial	Partial	Normal
  CVSS Temporal Score - 5.8
  Exploitability		Remediation Level		Report Confidence
  Functional		Official-Fix		Confirmed

  CSCsj19985 ( registered customers only) - Unauthorized administrators can start/stop CUPS services Calculate the environmental score of CSCsj19985
  CVSS Base Score - 7
  Access Vector	Access Complexity	Authentication	Confidentiality Impact	Integrity Impact	Availability Impact	Impact Bias
  Remote	Low	Not Required	Partial	Partial	Partial	Normal
  CVSS Temporal Score - 5.8
  Exploitability		Remediation Level		Report Confidence
  Functional		Official-Fix		Confirmed

  CSCsj20668 ( registered customers only) - Unauthorized administrators can view CUCM SNMP settings Calculate the environmental score of CSCsj20668
  CVSS Base Score - 2.3
  Access Vector	Access Complexity	Authentication	Confidentiality Impact	Integrity Impact	Availability Impact	Impact Bias
  Remote	Low	Not Required	Partial	None	None	Normal
  CVSS Temporal Score - 1.9
  Exploitability		Remediation Level		Report Confidence
  Functional		Official-Fix		Confirmed

  CSCsj25962 ( registered customers only) - Unauthorized administrators can view CUPS SNMP settings Calculate the environmental score of CSCsj25962
  CVSS Base Score - 2.3
  Access Vector	Access Complexity	Authentication	Confidentiality Impact	Integrity Impact	Availability Impact	Impact Bias
  Remote	Low	Not Required	Partial	None	None	Normal
  CVSS Temporal Score - 1.9
  Exploitability		Remediation Level		Report Confidence
  Functional		Official-Fix		Confirmed

Workarounds

• There are no workarounds for these vulnerabilities. It is possible to mitigate these vulnerabilities by permitting only trusted CUCM/CUPS cluster nodes and administrator workstations to access TCP port 8443 on a vulnerable CUCM/CUPS system.

  Although it is often difficult to block traffic transiting your network, it is possible to identify traffic which should never be allowed to target your infrastructure devices and block that traffic at the border of your network. Infrastructure ACLs are considered a network security best practice and should be considered as a long-term addition to good network security, as well as a workaround for this specific vulnerability. The filters shown above should be included as part of an infrastructure access list, which will protect all devices with IP addresses in the infrastructure IP address range.

  The white paper entitled "Protecting Your Core: Infrastructure Protection Access Control Lists" presents guidelines and recommended deployment techniques for infrastructure protection access lists. This document is available at the following link:

  http://www.cisco.com/en/US/tech/tk648/tk361/technologies_white_paper09186a00801a1a55.shtml

  Filters blocking access to TCP/8443 should be deployed at the network edge as part of a transit access list that will protect the router where the ACL is configured, as well as other devices behind it. Further information about transit ACLs is available in the white paper "Transit Access Control Lists: Filtering at Your Edge," which is available at the following link:

  http://www.cisco.com/en/US/tech/tk648/tk361/technologies_white_paper09186a00801afc76.shtml

  Additional mitigations that can be deployed on Cisco devices within the network are available in the Cisco Applied Intelligence companion document for this advisory: http://www.cisco.com/warp/public/707/cisco-air-20070711-cucm.shtml

Fixed Software

• When considering software upgrades, also consult http://www.cisco.com/go/psirt and any subsequent advisories to determine exposure and a complete upgrade solution.

  In all cases, customers should exercise caution to be certain the devices to be upgraded contain sufficient memory and that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, contact the Cisco Technical Assistance Center ("TAC") or your contracted maintenance provider for assistance.

Exploitation and Public Announcements

• The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory.

  These vulnerabilities were discovered internally by Cisco.

URL

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20070711-voip

Revision History

• Revision 1.0

  2007-July-11

  Initial public release.

  Show Less