Detections
Analytics
Cisco Unity Connection libSRTP Denial of Service Vulnerability
high Nessus Plugin ID 130017
Language:
Synopsis
The remote host is missing a vendor-supplied security patch.Description
A vulnerability in local file management for Cisco Unity Connection could allow an unauthenticated, remote attacker to cause high disk utilization, resulting in a denial of service (DoS) condition.The vulnerability occurs because a certain system log file does not have a maximum size restriction.
Therefore, the file is allowed to consume the majority of available disk space on the appliance.
An attacker could exploit this vulnerability by sending crafted remote connection requests to the appliance. Successful exploitation could allow the attacker to increase the size of a system log file so that it consumes most of the disk space. The lack of available disk space could lead to a DoS condition in which the application functions could operate abnormally, making the appliance unstable.
Solution
Apply the patch or upgrade to the version recommended in Cisco bug ID CSCvf64332See Also
Plugin Details
Severity: High
ID: 130017
File Name: cisco-sa-20180606-diskdos-uc.nasl
Version: 1.2
Type: local
Family: CISCO
Published: 10/18/2019
Updated: 10/18/2019
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.6
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 5.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C
CVSS Score Source: CVE-2017-6779
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:cisco:unity_connection
Required KB Items: installed_sw/Cisco VOSS Unity
Exploit Ease: No known exploits are available
Patch Publication Date: 6/6/2018
Vulnerability Publication Date: 6/6/2018
Reference Information
CVE: CVE-2017-6779
BID: 104662