CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
EPSS
Percentile
78.5%
The Cisco Call Manager contains a vulnerability that could permit an intruder to crash the Call Manager.
The Cisco Call Manageris software to manage telephone calls in a mixed data and voice environment. Specifically the Cisco Call Manager “extends enterprise telephony features and functions to packet telephony network devices such as IP phones, media processing devices, voice-over-IP (VoIP) gateways, and multimedia applications.1”
The software contains a vulnerability that allows could permit an intruder to consume memory until the system crashes. Quoting from Cisco’s Security Advisory:
The Cisco CallManager, running certain software releases, has a vulnerability wherein a memory leak in the CTI Framework authentication can cause the server to crash and result in a reload. This vulnerability can be exploited to initiate a denial of service (DoS) attack.
It may be possible for the vulnerability to be triggered accidentally. For more information, see the vendor statement from Cisco below.
An intruder could interrupt the normal function of the Cisco Call Manager, causing it to crash and reload.
Upgrade to a more recent version of Cisco Call Manager, as described in <http://www.cisco.com/warp/public/707/callmanager-ctifw-leak-pub.shtml>.
495275
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Expand all
Javascript is disabled. Click here to view vendors.
Updated: August 09, 2002
Affected
-----BEGIN PGP SIGNED MESSAGE-----
UPDATED: Cisco Security Advisory: LDAP Connection Leak in CTI when User Authentication Fails
The Cisco Security Advisory regarding a memory leak in LDAP connections when CTI user authentication fails has been updated with new information. Cisco is reissuing this advisory because the affected software versions and first fixed releases information was listed incorrectly in previous versions of the advisory. Cisco CallManager version 3.0 is affected and the first fixed release is Cisco CallManager version 3.1(3a). Customers running 3.1(3a) or later are still unaffected.
- -------------------------------------------------------------------------
Cisco Security Advisory: LDAP Connection Leak in CTI when User Authentication Fails
Revision 1.2
For Public Release 2002 March 27 17:00 GMT
Last Updated 2002 March 29 18:00 GMT
- -------------------------------------------------------------------------------
Contents
Summary Affected Products Details Impact Software Versions and Fixes Obtaining Fixed Software Workarounds Exploitation and Public Announcements Status of This Notice Distribution Revision History Cisco Security Procedures
- -------------------------------------------------------------------------------
Summary
The Cisco CallManager, running certain software releases, has a vulnerability wherein a memory leak in the CTI Framework authentication can cause the server to crash and result in a reload. This vulnerability can be exploited to initiate a denial of service (DoS) attack.
This vulnerability is documented as Cisco bug ID CSCdv28302. There are workarounds available to mitigate the vulnerability.
This advisory is available at ``<http://www.cisco.com/warp/public/707/callmanager-ctifw-leak-pub.shtml>``.
Affected Products
To determine if a product is vulnerable, review the list below. If the software versions or configuration information are provided, then only those combinations are vulnerable.
* Cisco CallManager 3.0, 3.1
No other Cisco product is known to be affected by this vulnerability.
Details
A memory leak in the Cisco CallManager has been attributed to the failure of a user to properly authenticate when using Computer Telephony Integration (CTI). This behavior is most commonly seen on CallManager systems immediately following the integration with a customer directory such as Active Directory (AD) or Netscape. The most common cause in this scenario is that the WebAttendant user, CTI Framework (CTIFW), has not been configured with a valid password in the customer directory. Please note that this problem will occur even on systems that do not utilize the WebAttendant since the Telephony Call Dispatch (TCD) service is always enabled by default. The CCMAdmin->Global Directory and "Add a New User" configuration pages stop working if CTIFW user is not configured or the CTI user's password is incorrect. Various other components such as RIS Data Collector may also fail to function properly.
Bug ID This vulnerability is documented as Cisco Bug ID CSCdv28302.
Problem Symptoms
There are several indicators available in determining if this problem is at the root.
LDAP Leak Detection +-----------------------------------------------------+ | Tool | Message | |-------+---------------------------------------------| | |Error: kCtiProviderOpenFailure - CTI | | |application failed to open provider | | |CTIconnectionId: 485 | | |Login User Id: CtiFw | | |ReasonCode: 2362179680 | | |IPAddress: 172.21.12.44 | | |App ID: Cisco CTIManager | | |Cluster ID: JMTAO-CM2-Cluster | |Event |Node ID: JMTAO-CM2 | |Viewer |CTI Application ID: Cisco Telephony Call | | |Dispatcher | | |Process ID: 0 | | |Process Name: CtiHandler | | |Provider Name: CTI Framework | | |Explanation: Application is unable to open | | |provider. | | |Recommended Action: Check the reason code and| | |correct the problem. Restart | | |CTIManager if problem persists.. | |-------+---------------------------------------------| | |From the Task Manager select the Processes | | |tab, click View and then Select Columns... | |Task |Check Handle Count and click OK. | |Manager|Click on the Handles column to sort by | | |handles used. | | |You will observe that the CTIManager.exe is | | |consuming a large number of handles (> 500). | |-------+---------------------------------------------| | |Another diagnostic tool is to run "netstat | | |-na" from a DOS command prompt on the CM | |DOS |server. A very large number of established | |netstat|connections to TCP port 389 if CallManager is| | |integrated with AD or port 8404 when | | |CallManager is integrated with DCD. | +-----------------------------------------------------+
Impact
The vulnerabilities can be exploited to produce a Denial of Service (DoS) attack. When the vulnerabilities are exploited, they can cause an affected Cisco product to crash and reload.
Software Versions and Fixes
+-----------------------------------------------------+ |Version |Fixed Regular Release (available now) | |Affected |Fix carries forward into all later | | |versions | |--------------+--------------------------------------| |Version 3.0 |Upgrade to 3.1(3a) | |--------------+--------------------------------------| |Version 3.1 |Upgrade to 3.1(3a) | +-----------------------------------------------------+
Obtaining Fixed Software
Cisco is offering free software upgrades to address this vulnerability for all affected customers. Customers may only install and expect support for the feature sets they have purchased.
Customers with service contracts should contact their regular update channels to obtain any software release containing the feature sets they have purchased. For most customers with service contracts, this means that upgrades should be obtained through the Software Center on Cisco's Worldwide Web site at ``<http://www.cisco.com>``.
Customers whose Cisco products are provided or maintained through a prior or existing agreement with third-party support organizations such as Cisco Partners, authorized resellers, or service providers should contact that support organization for assistance with obtaining the free software upgrade (s).
Customers who purchased directly from Cisco but who do not hold a Cisco service contract, and customers who purchase through third party vendors but are unsuccessful at obtaining fixed software through their point of sale, should obtain fixed software by contacting the Cisco Technical Assistance Center (TAC) using the contact information listed below. In these cases, customers are entitled to obtain an upgrade to a later version of the same release or as indicated by the applicable row in the Software Versions and Fixes table (noted above).
Cisco TAC contacts are as follows:
` * +1 800 553 2447 (toll free from within North America)
See <http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml>
for additional
Please have your product serial number available and give the URL of this
Please do not contact either “[email protected]” or “[email protected]”
Workarounds
Configure the ctifw user by following the instructions at:<http://www.cisco.com/univercd/cc/td/doc/product/voice/c_callmg/3_0/install/ad_3011.htm#xtocid30717>
±----------------------------------------------------+
IMPORTANT: Please note that you must reboot the CM server in all cases to reset
Alternatively, if you are not using the Cisco WebAttendant and/or the Cisco
Exploitation and Public Announcements
The Cisco PSIRT is not aware of any public announcements or malicious use of
Status of This Notice: Interim
This is a Interim advisory. Although Cisco cannot guarantee the accuracy of all
Distribution
This notice will be posted on Cisco’s Worldwide Web site at<http://www.cisco.com/warp/public/707/callmanager-ctifw-leak-pub.shtml>
.
* [email protected]
Future updates of this notice, if any, will be placed on Cisco’s Worldwide Web
Revision History
±----------------------------------------------------+
Cisco Security Procedures
Complete information on reporting security vulnerabilities in Cisco products,<http://www.cisco.com/warp/public/707/sec_incident_response.shtml>
. This includes<http://www.cisco.com/go/psirt>
.
- -------------------------------------------------------------------------------
This notice is Copyright 2002 by Cisco Systems, Inc. This notice may be
- ------------------------------------------------------------------------------------BEGIN PGP SIGNATURE----- Version: PGP 6.5.2
iQEVAwUBPKTTDw/VLJ+budTTAQFKwAf/e0YPKtvZPXVCTK7uyLAPfs8uUWVXB+6l yXpTVVW1Uvjm9jW0l8Ko8Q8MzV0IMxp4gFG0W4rZag8JkZX+ocvq8TL2oussxFZa vE+5mezZoLH6ZWcNBfgdtAt7mIbUxh5dzePaLqRdj95VzBVne2c3GPAeTlNJdZNu rSMKbDPE/JKvCrTvMxoKfX4r4i9ttSrrSjdKeTAOVZSM/PQlbb1kaqYVcf1Se/78 RVKuLhr7es3vZCeYjknMS7lKvZDya5QoDkaIl0KXwXeDQVa7kCVpGYhyow/HTNNG XQ6vdkUkVANKxWCUbb6R5frvCs18AKAjHxDtgPWAPdEs3VarWqhaGg== =6WaS -----END PGP SIGNATURE-----
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23495275 Feedback>).
Group | Score | Vector |
---|---|---|
Base | ||
Temporal | ||
Environmental |
Thanks to Cisco Systems Product Security Incident Response Team for reporting this vulnerability.
This document was written by Shawn V Hernan, based on information provided by Cisco Systems.
CVE IDs: | CVE-2002-0505 |
---|---|
Severity Metric: | 5.63 Date Public: |