Cisco has released nine security advisories for various products, including eight for its ubiquitous IOS operating system. Many of the vulnerabilities fixed in the patch release are denial-of-service flaws and none of them can give an attacker the ability to run code remotely on affected machines.
The one bulletin that doesn’t relate to IOS is for a vulnerability in the Cisco Unified Communications Manager. That flaw is a DoS bug in the SIP (session initiation protocol) implementation in UCM. SIP is used in a variety of products to help set up voice and video calls on IP networks.
“A vulnerability exists in the SIP implementation in Cisco Unified Communications Manager that could allow a remote attacker to cause a critical service to fail, which could interrupt voice services. This vulnerability is triggered when an affected device processes a crafted SIP message that contains a valid Session Description Protocol (SDP) message. Only traffic destined to the device can trigger the vulnerability; transit SIP traffic is not an exploit vector,” Cisco said in its advisory.
One of the IOS vulnerabilities is also related to SIP and could result in a denial of service for affected machines.
“A vulnerability exists in the SIP implementation in Cisco IOS Software and Cisco IOS XE Software that could allow a remote attacker to cause an affected device to reload. This vulnerability is triggered when an affected device processes a crafted SIP message that contains a valid Session Description Protocol (SDP) message. Only traffic destined to the device can trigger the vulnerability; transit SIP traffic is not an exploit vector. SDP pass-through must be enabled, either at the global level, or at the dial-peer level, for a device to be affected by this vulnerability,” the advisory says.
There also is a vulnerability in the BGP implementation in IOS that could wind up preventing affected machines from being able to route BGP packets to neighboring peers.
“Cisco IOS Software contains a vulnerability in the BGP routing protocol feature. This vulnerability affects Cisco IOS Software, Cisco IOS-XR Software, and Cisco IOS-XE Software. Cisco NXOS Software is not affected. The vulnerability may be triggered when the router receives a malformed attribute from a peer on an existing BGP session. At least one BGP neighbor session must be established for a router to be vulnerable. Successful exploitation of this vulnerability may cause all BGP peers to reset. Repeated exploitation may result in an inability to route packets to BGP neighbors during reconvergence times,” Cisco said.
Check out the full list of Cisco security advisories to see which of your products are affected by the vulnerabilities.
