----------------------------------------------------------------------

Did you know that a change in our assessment rating, exploit code
availability, or if an updated patch is released by the vendor, is
not part of this mailing-list?

Click here to learn more:
http://secunia.com/advisories/business_solutions/

----------------------------------------------------------------------

TITLE:
Cisco Unified Communications Manager CAPF Denial of Service

SECUNIA ADVISORY ID:
SA33588

VERIFY ADVISORY:
http://secunia.com/advisories/33588/

CRITICAL:
Less critical

IMPACT:
DoS

WHERE:
>From local network

SOFTWARE:
Cisco Unified Communications Manager 5.x
http://secunia.com/advisories/product/11019/
Cisco Unified Communications Manager 6.x
http://secunia.com/advisories/product/14776/

DESCRIPTION:
A vulnerability has been reported in Cisco Unified Communications
Manager, which can be exploited by malicious people to cause a DoS
(Denial of Service).

The vulnerability is cause due to unspecified errors in the
Certificate Authority Proxy Function (CAPF) service when processing
malformed input. This can be exploited to interrupt voice services by
sending malformed data to the CAPF service on TCP port 3804.

Successful exploitation of this vulnerability requires that the CAPF
service is enabled.

This vulnerability is reported in versions 5.1 prior to 5.1(3e) and
6.1 prior to 6.1(3).

SOLUTION:
Cisco Unified Communications Manager version 5.1:
Upgrade to 5.1(3e).

Cisco Unified Communications Manager version 6.1:
Upgrade to 6.1(3).

PROVIDED AND/OR DISCOVERED BY:
The vendor credits VoIPshield.

ORIGINAL ADVISORY:
cisco-sa-20090121-cucmcapf:
http://www.cisco.com/en/US/products/products_security_advisory09186a0080a61928.shtml

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------