Cisco Unified Communications Manager IM & Presence Service XCP Authentication Service memory allocation

Summaryinfo

A vulnerability marked as problematic has been reported in Cisco Unified Communications Manager IM & Presence Service. Impacted is an unknown function of the component XCP Authentication Service. The manipulation leads to memory allocation. This vulnerability is listed as CVE-2023-20108. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Cisco Unified Communications Manager IM & Presence Service (Unified Communication Software) (the affected version is unknown). It has been rated as critical. This issue affects an unknown code of the component XCP Authentication Service. The manipulation with an unknown input leads to a memory allocation vulnerability. Using CWE to declare the problem leads to CWE-789. The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated. Impacted is availability. The summary by CVE is:

A vulnerability in the XCP Authentication Service of the Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an unauthenticated, remote attacker to cause a temporary service outage for all Cisco Unified CM IM&P users who are attempting to authenticate to the service, resulting in a denial of service (DoS) condition. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted login message to the affected device. A successful exploit could allow the attacker to cause an unexpected restart of the authentication service, preventing new users from successfully authenticating. Exploitation of this vulnerability does not impact Cisco Unified CM IM&P users who were authenticated prior to an attack.

The weakness was presented 06/28/2023 as cisco-sa-cucm-imp-dos-49GL7rzT. It is possible to read the advisory at sec.cloudapps.cisco.com. The identification of this vulnerability is CVE-2023-20108 since 10/27/2022. The technical details are unknown and an exploit is not publicly available.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2023-24287). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Unified Communication Software

Vendor

• Cisco

Name

• Unified Communications Manager IM & Presence Service

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion