----------------------------------------------------------------------

A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI
has been released. The new version includes many new and advanced
features, which makes it even easier to stay patched.

Download and test it today:
https://psi.secunia.com/

Read more about this new version:
https://psi.secunia.com/?page=changelog

----------------------------------------------------------------------

TITLE:
Cisco Unified Communications Manager CTL Provider Service Buffer
Overflow

SECUNIA ADVISORY ID:
SA28530

VERIFY ADVISORY:
http://secunia.com/advisories/28530/

CRITICAL:
Moderately critical

IMPACT:
DoS, System access

WHERE:
>From local network

SOFTWARE:
Cisco Unified CallManager 4.x
http://secunia.com/product/12534/
Cisco Unified Communications Manager 4.x
http://secunia.com/product/5363/

DESCRIPTION:
Cody Pierce has reported a vulnerability in Cisco Unified
Communications Manager (CUCM), which can be exploited by malicious
people to cause a DoS (Denial of Service) or compromise a vulnerable
system.

The vulnerability is caused due to a boundary error in the CTL
Provider Service (CTLProvider.exe) and can be exploited to cause a
heap-based buffer overflow via a specially crafted packet sent to
default port 2444/TCP.

Successful exploitation allows execution of arbitrary code.

The vulnerability affects the following versions:
* Cisco Unified CallManager 4.0
* Cisco Unified CallManager 4.1 versions prior to 4.1(3)SR5c
* Cisco Unified Communications Manager 4.2 versions prior to
4.2(3)SR3
* Cisco Unified Communications Manager 4.3 versions prior to
4.3(1)SR1

SOLUTION:
Apply updates.

CUCM 4.0:
Update to a fixed version of CUCM 4.1 or later.

CUCM 4.1:
Update to CUCM 4.1(3)SR5c, CUCM 4.1(3)SR6, or later.
http://www.cisco.com/pcgi-bin/tablebuild.pl/callmgr-41?psrtdcat20e2

CUCM 4.2:
Update to CUCM 4.2(3)SR3 or later.
http://www.cisco.com/pcgi-bin/tablebuild.pl/callmgr-42?psrtdcat20e2

CUCM 4.3:
Update to CUCM 4.3(1)SR1, CUCM 4.3(1)SR1a, or later.
http://www.cisco.com/pcgi-bin/tablebuild.pl/callmgr-43?psrtdcat20e2

PROVIDED AND/OR DISCOVERED BY:
Cody Pierce, TippingPoint DVLabs

ORIGINAL ADVISORY:
TPTI-08-02:
http://dvlabs.tippingpoint.com/advisory/TPTI-08-02

Cisco (100345):
http://www.cisco.com/warp/public/707/cisco-sa-20080116-cucmctl.shtml

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------