CVE-2012-0331

Cisco TelePresence Video Communication Server with software before X7.0.1 allows remote attackers to cause a denial of service (device crash) via a crafted SIP packet, as demonstrated by a SIP INVITE message from a Tandberg device, aka Bug ID CSCtq73319.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120229-vcs	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:cisco:telepresence_system_software::::::::
	cpe:2.3:a:cisco:telepresence_system_software:x5.2:::::::*
	cpe:2.3:a:cisco:telepresence_system_software:x6.0:::::::*
	cpe:2.3:a:cisco:telepresence_system_software:x6.1:::::::*

OR	cpe:2.3:h:cisco:telepresence_video_communication_server:::control:::::*
	cpe:2.3:h:cisco:telepresence_video_communication_server:::expressway:::::*
	cpe:2.3:h:cisco:telepresence_video_communication_server:::starter_pack_express:::::*

History

No history.

Information

Published : 2012-03-01 01:55

Updated : 2024-02-28 11:41

NVD link : CVE-2012-0331

Mitre link : CVE-2012-0331

CVE.ORG link : CVE-2012-0331

JSON object : View

Products Affected

cisco

telepresence_video_communication_server
telepresence_system_software

CWE

CWE-399

Resource Management Errors

{"id": "CVE-2012-0331", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2012-03-01T01:55:00.847", "references": [{"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120229-vcs", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-399"}]}], "descriptions": [{"lang": "en", "value": "Cisco TelePresence Video Communication Server with software before X7.0.1 allows remote attackers to cause a denial of service (device crash) via a crafted SIP packet, as demonstrated by a SIP INVITE message from a Tandberg device, aka Bug ID CSCtq73319."}, {"lang": "es", "value": "Cisco TelePresence Video Communication Server con software anterior a v7.0.1 permite a atacantes remotos provocar una denegaci\u00f3n de servicio (ca\u00edda de dispositivo) a trav\u00e9s de un paquete SIP manipulado, como se demostr\u00f3 con un mensaje SIP INVITE desde un dispositivo Tandberg, tambi\u00e9n conocido como Bug ID CSCtq73319."}], "lastModified": "2012-03-01T05:00:00.000", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:telepresence_system_software:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ACC0FAA0-8922-4BD8-BCA6-0182D073116F", "versionEndIncluding": "x7.0"}, {"criteria": "cpe:2.3:a:cisco:telepresence_system_software:x5.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9D308C8B-440D-424F-85A2-5CE54DF7D312"}, {"criteria": "cpe:2.3:a:cisco:telepresence_system_software:x6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F6D76D53-288D-4EB2-95EF-EB5F15F765FD"}, {"criteria": "cpe:2.3:a:cisco:telepresence_system_software:x6.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F3C8A2B4-E5D9-46C9-ABAB-9FF52707F259"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:cisco:telepresence_video_communication_server:*:*:control:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "53E85380-299F-4282-9CE7-DDAF3F31EC41"}, {"criteria": "cpe:2.3:h:cisco:telepresence_video_communication_server:*:*:expressway:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1F6BA840-8C48-49FB-B2F0-D759CF556252"}, {"criteria": "cpe:2.3:h:cisco:telepresence_video_communication_server:*:*:starter_pack_express:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CF5F8E71-5FCD-4DE0-97D5-459F6F101916"}], "operator": "OR"}], "operator": "AND"}], "evaluatorComment": "Per: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120229-vcs\r\n\r\n'Vulnerable Products\r\nThese vulnerabilities affect all three variants (Control, Expressway, and Starter Pack Express) of Cisco TelePresence Video Communication Server.'", "sourceIdentifier": "ykramarz@cisco.com"}