Breaking News Evernote, which makes business and consumer productivity software for things like taking notes and doing research.|| Facebook is about to launch a redesign of its News Feed feature.||A PayPal alliance with Coinstar is being expanded to some parts of the U.S., allowing customers to deposit, withdraw and transfer funds to PayPal accounts through Coinstar kiosks.||Microsoft has disclosed that it recently fell victim to the same type of cyberattack that targeted Apple and Facebook.|| Like us on facebook Click Here -  BD IT NEWS News HeadLine
Cisco patches serious vulnerabilities in Unified Communications Manager

Publish Date : ৮/২৬/২০১৩ Editor : BDITNEWS Total Reader : 1490


No Image
Close

Cisco Systems has released new security patches for several versions of Unified Communications Manager (UCM) to address vulnerabilities that could allow remote attackers to execute arbitrary commands, modify system data or disrupt services.

The UCM is the call processing component of Cisco's IP Telephony solution. It connects to IP (Internet Protocol) phones, media processing devices, VoIP gateways, and multimedia applications and provides services such as session management, voice, video, messaging, mobility, and web conferencing.

The most serious vulnerability addressed by the newly released patches can lead to a buffer overflow and is identified as CVE-2013-3462 in the Common Vulnerabilities and Exposures database. This vulnerability can be exploited remotely, but it requires the attacker to be authenticated on the device.

"An attacker could exploit this vulnerability by overwriting an allocated memory buffer on an affected device," Cisco said Wednesday in a security advisory. "An exploit could allow the attacker to corrupt data, disrupt services, or run arbitrary commands."

The CVE-2013-3462 vulnerability affects versions 7.1(x), 8.5(x), 8.6(x), 9.0(x) and 9.1(x) of Cisco UCM, Cisco said.

The company also patched three denial-of-service (DoS) flaws that can be remotely exploited by unauthenticated attackers.

One of them, identified as CVE-2013-3459, is caused by improper error handling and can be exploited by sending malformed registration messages to the affected devices. The flaw only affects Cisco UCM 7.1(x) versions.

The second DoS issue is identified as CVE-2013-3460 and is caused by insufficient limiting of traffic received on certain UDP ports. It can be exploited by sending UDP packets at a high rate on those specific ports to devices running versions 8.5(x), 8.6(x), and 9.0(x) of Cisco UCM.

The third vulnerability, identified as CVE-2013-3461, is similar but only affects the Session Initiation Protocol (SIP) port. "An attacker could exploit this vulnerability by sending UDP packets at a high rate to port 5060 on an affected device," Cisco said. The vulnerability affects Cisco UCM versions 8.5(x), 8.6(x) and 9.0(1).

Patched versions have been released for all UCM release branches affected by these vulnerabilities and there are no known workarounds at the time that would mitigate the flaws without upgrading.

All of the patched vulnerabilities were discovered during internal testing and the company's product security incident response team (PSIRT) is not aware of any cases where these issues have been exploited or publicly documented.

"In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release," Cisco said. "If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers."

Reference: itworld.com


















The special version of the aviator replica watches uk is engraved with a rolex replica "EDITION LE PETIT PRINCE" engraved on the airtight watch and the image of a little replica watches prince wearing a coat and saber drawn in the replica watches online 1940s by Anthony Santois.