Vulnerability Name:

CVE-2006-5277 (CCN-31437)

Assigned:2006-10-13
Published:2007-07-11
Updated:2018-10-17
Summary:Off-by-one error in the Certificate Trust List (CTL) Provider service (CTLProvider.exe) in Cisco Unified Communications Manager (CUCM, formerly CallManager) before 20070711 allow remote attackers to execute arbitrary code via a crafted packet that triggers a heap-based buffer overflow.
CVSS v3 Severity:10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
6.9 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
10.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
7.4 High (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-Other
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2006-5277

Source: CCN
Type: SA26043
Cisco Unified Communications Manager Two Vulnerabilities

Source: SECUNIA
Type: Third Party Advisory
26043

Source: CCN
Type: SECTRACK ID: 1018369
Cisco Unified Communications Manager Heap Overflows Let Remote Users Execute Arbitrary Code

Source: SECTRACK
Type: Third Party Advisory, VDB Entry
1018369

Source: CCN
Type: cisco-sa-20070711-cucm
Cisco Security Advisory: Cisco Unified Communications Manager Overflow Vulnerabilities

Source: CISCO
Type: Vendor Advisory
20070711 Cisco Unified Communications Manager Overflow Vulnerabilities

Source: CCN
Type: IBM Internet Security Systems Protection Advisory July 11, 2007
Cisco Call Manager CTLProvider.exe Remote Code Execution

Source: ISS
Type: Broken Link
20070711 Cisco Call Manager CTLProvider.exe Remote Code Execution

Source: OSVDB
Type: Broken Link
36122

Source: CCN
Type: OSVDB ID: 36122
Cisco Unified Communications Manager (CUCM) Certificate Trust List (CTL) Provider Service (CTLProvider.exe) Remote Overflow

Source: BID
Type: Third Party Advisory, VDB Entry
24868

Source: CCN
Type: BID-24868
Cisco Unified Communications Manager Multiple Heap Buffer Overflow Vulnerabilities

Source: VUPEN
Type: Permissions Required, Third Party Advisory
ADV-2007-2512

Source: XF
Type: Third Party Advisory, VDB Entry
voip-filename-overflow(31437)

Source: XF
Type: UNKNOWN
voip-filename-overflow(31437)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:cisco:unified_callmanager:*:*:*:*:*:*:*:* (Version >= 3.3 and <= 3.3(5)sr2)
  • OR cpe:/a:cisco:unified_callmanager:*:*:*:*:*:*:*:* (Version >= 4.1 and <= 4.1(3)sr4)
  • OR cpe:/a:cisco:unified_callmanager:*:*:*:*:*:*:*:* (Version >= 4.2 and <= 4.2(3)sr1)
  • OR cpe:/a:cisco:unified_callmanager:5.0:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:unified_communications_manager:*:*:*:*:*:*:*:* (Version >= 4.3 and <= 4.3(1))
  • OR cpe:/a:cisco:unified_communications_manager:*:*:*:*:*:*:*:* (Version >= 5.1 and <= 5.1(1))

  • Configuration CCN 1:
  • cpe:/a:cisco:unified_callmanager:5.0:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:unified_callmanager:3.3(5)sr2:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:unified_callmanager:4.1(3)sr4:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:unified_callmanager:4.2(3)sr1:*:*:*:*:*:*:*
  • OR cpe:/a:cisco:unified_communications_manager:4.3(1):*:*:*:*:*:*:*
  • OR cpe:/a:cisco:unified_communications_manager:5.1(1):*:*:*:*:*:*:*

  • * Denotes that component is vulnerable
    BACK
    cisco unified callmanager *
    cisco unified callmanager *
    cisco unified callmanager *
    cisco unified callmanager 5.0
    cisco unified communications manager *
    cisco unified communications manager *
    cisco unified callmanager 5.0
    cisco unified callmanager 3.3(5)sr2
    cisco unified callmanager 4.1(3)sr4
    cisco unified callmanager 4.2(3)sr1
    cisco unified communications manager 4.3(1)
    cisco unified communications manager 5.1(1)