Cisco – Vulnerability in Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) CPU usage

Advisory IDRSN-SIP-1614

Vulnerability Information

A vulnerability in the phone book feature of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to cause the CPU to increase to 100% utilization, causing a denial of service (DoS) condition on an affected system. The vulnerability is due to improper handling of the XML input. An attacker could exploit this vulnerability by sending a Session Initiation Protocol (SIP) message with a crafted XML payload to an affected device. A successful exploit could allow the attacker to exhaust CPU resources, resulting in a DoS condition. Manual intervention may be required to recover the device. This vulnerability is fixed in Cisco Expressway Series and Cisco TelePresence Video Communication Server Releases X12.5.1 and later.

Technical Information

An attacker could send a Session Initiation Protocol (SIP) message with a crafted XML payload to an affected device that is performing NAT for SIP packets and allow the attacker to cause the device to reload, resulting in a denial of service (DoS) condition.

Solutions

The UCTM solution from RedShift Networks provides the industry’s first complete security solution developed to secure VOIP networks, endpoints and applications. His research team Condor-Labs.com is constantly looking for new attack patterns, advanced penetration testing methods, vulnerability identification and deployment of new signatures for constantly subscribed clients. For more information visit www.redshiftnetworks.com

External Resources

Cisco Security Advisory

Common Vulnerabilities and Exposures (CVE)