Cisco Unity Connection libSRTP Denial of Service Vulnerability

high Nessus Plugin ID 130017

Synopsis

The remote host is missing a vendor-supplied security patch.

Description

A vulnerability in local file management for Cisco Unity Connection could allow an unauthenticated, remote attacker to cause high disk utilization, resulting in a denial of service (DoS) condition.
The vulnerability occurs because a certain system log file does not have a maximum size restriction.
Therefore, the file is allowed to consume the majority of available disk space on the appliance.
An attacker could exploit this vulnerability by sending crafted remote connection requests to the appliance. Successful exploitation could allow the attacker to increase the size of a system log file so that it consumes most of the disk space. The lack of available disk space could lead to a DoS condition in which the application functions could operate abnormally, making the appliance unstable.

Solution

Apply the patch or upgrade to the version recommended in Cisco bug ID CSCvf64332

See Also

http://www.nessus.org/u?c6ab2b07

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvf64332

Plugin Details

Severity: High

ID: 130017

File Name: cisco-sa-20180606-diskdos-uc.nasl

Version: 1.2

Type: local

Family: CISCO

Published: 10/18/2019

Updated: 10/18/2019

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2017-6779

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:cisco:unity_connection

Required KB Items: installed_sw/Cisco VOSS Unity

Exploit Ease: No known exploits are available

Patch Publication Date: 6/6/2018

Vulnerability Publication Date: 6/6/2018

Reference Information

CVE: CVE-2017-6779

BID: 104662

CWE: 399

CISCO-SA: cisco-sa-20180606-diskdos

CISCO-BUG-ID: CSCvf64332