CVE-2017-6648
Description
A vulnerability in the Session Initiation Protocol (SIP) of the Cisco TelePresence Codec (TC) and Collaboration Endpoint (CE) Software could allow an unauthenticated, remote attacker to cause a TelePresence endpoint to reload unexpectedly, resulting in a denial of service (DoS) condition. The vulnerability is due to a lack of flow-control mechanisms within the software. An attacker could exploit this vulnerability by sending a flood of SIP INVITE packets to the affected device. An exploit could allow the attacker to impact the availability of services and data of the device, including a complete DoS condition. This vulnerability affects the following Cisco TC and CE platforms when running software versions prior to TC 7.3.8 and CE 8.3.0. Cisco Bug IDs: CSCux94002.
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco telepresence_ce_software | 8.2.2 | — |
| cisco telepresence_tc_software | 3.1.5, 3.1_base, 4.1.0, 4.1.1, 4.1.2, 4.1_base, 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.2.4, 4.2_base, 5.0.2, 5.0.2-cucm, 5.0_base, 5.1.3, 5.1.3-cucm, 5.1.4, 5.1.4-cucm, 5.1.5, 5.1.5-cucm, 5.1.6, 5.1.6-cucm, 5.1.7, 5.1.7-cucm, 5.1.11, 5.1.13, 5.1_base, 6.0.0, 6.0.0-cucm, 6.0.1, 6.0.1-cucm, 6.0.2, 6.0.3, 6.0.4, 6.0_base, 6.1.0, 6.1.0-cucm, 6.1.1, 6.1.1-cucm, 6.1.2, 6.1.2-cucm, 6.1.3, 6.1.4, 6.1_base, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.6, 7.3.7, 8.2.0, 8.2.1 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.