CVE-2017-6779 in VOS
Summary
by MITRE
Multiple Cisco products are affected by a vulnerability in local file management for certain system log files of Cisco collaboration products that could allow an unauthenticated, remote attacker to cause high disk utilization, resulting in a denial of service (DoS) condition. The vulnerability occurs because a certain system log file does not have a maximum size restriction. Therefore, the file is allowed to consume the majority of available disk space on the appliance. An attacker could exploit this vulnerability by sending crafted remote connection requests to the appliance. Successful exploitation could allow the attacker to increase the size of a system log file so that it consumes most of the disk space. The lack of available disk space could lead to a DoS condition in which the application functions could operate abnormally, making the appliance unstable. This vulnerability affects the following Cisco Voice Operating System (VOS)-based products: Emergency Responder, Finesse, Hosted Collaboration Mediation Fulfillment, MediaSense, Prime License Manager, SocialMiner, Unified Communications Manager (UCM), Unified Communications Manager IM and Presence Service (IM&P - earlier releases were known as Cisco Unified Presence), Unified Communication Manager Session Management Edition (SME), Unified Contact Center Express (UCCx), Unified Intelligence Center (UIC), Unity Connection, Virtualized Voice Browser. This vulnerability also affects Prime Collaboration Assurance and Prime Collaboration Provisioning. Cisco Bug IDs: CSCvd10872, CSCvf64322, CSCvf64332, CSCvi29538, CSCvi29543, CSCvi29544, CSCvi29546, CSCvi29556, CSCvi29571, CSCvi31738, CSCvi31741, CSCvi31762, CSCvi31807, CSCvi31818, CSCvi31823.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/31/2025
This vulnerability resides in the local file management system of Cisco collaboration products, specifically affecting the handling of system log files within Cisco Voice Operating System VOS-based appliances. The flaw represents a classic resource exhaustion issue where the system lacks proper size restrictions on critical log files, allowing them to grow indefinitely without monitoring or limitation mechanisms. This design oversight creates a significant security risk that can be exploited remotely without authentication, making it particularly dangerous in production environments where continuous operation is essential. The vulnerability is classified under CWE-16 as "Improper Configuration' and aligns with ATT&CK technique T1499.004 for 'Endpoint Denial of Service' through resource consumption.
The technical exploitation occurs when an unauthenticated remote attacker sends specially crafted connection requests to the affected appliance, which triggers the system to continuously append data to the unrestricted log file. This process leads to uncontrolled disk space consumption, ultimately causing the appliance to become unstable and potentially unusable. The lack of maximum size restrictions on log files creates a scenario where malicious actors can consume disk space at will, leading to system instability and denial of service conditions. The vulnerability affects multiple Cisco collaboration products including Unified Communications Manager, Unity Connection, and various other components within the Cisco collaboration ecosystem, making it particularly widespread across the enterprise communication infrastructure.
The operational impact of this vulnerability extends beyond simple service disruption to encompass complete system instability and potential business continuity issues. When disk space becomes exhausted, critical application functions begin to fail, resulting in abnormal operation of the appliance and making it unreliable for communication services. The affected products include mission-critical components such as Emergency Responder, Finesse, and Unified Communications Manager, which are essential for enterprise voice and collaboration services. This vulnerability can be exploited by attackers to create persistent denial of service conditions that may require manual intervention to resolve, including disk cleanup operations or complete system restarts. The attack vector requires no authentication credentials, making it particularly dangerous as any remote user can potentially exploit this weakness.
Organizations should implement immediate mitigations including configuring log rotation policies, setting maximum file size limits, and monitoring disk space utilization on affected systems. The recommended approach involves establishing automatic log file rotation mechanisms and implementing strict size limits on system log files to prevent uncontrolled growth. Security teams should also deploy monitoring solutions that can detect abnormal disk space consumption patterns and alert administrators to potential exploitation attempts. Cisco has released patches addressing this vulnerability through multiple bug fixes identified in the bug ID list, and organizations should prioritize applying these updates to their affected systems. Network segmentation and access control measures can provide additional defense-in-depth protection, although the vulnerability's remote and unauthenticated nature makes complete protection challenging without proper configuration of log file management policies.