Cisco Call Manager RisDC.exe Remote Code Execution

Notification Type: IBM Internet Security Systems Protection Advisory
Notification Date: July 11, 2007
Notification Version: 1.0
   
Name: Cisco Call Manager RisDC.exe Remote Code Execution
Public disclosure/
In the wild date:		 July 11, 2007 (vuln disclosure)
CVE: CVE-2006-5278
Description:

The RisDC.exe component of the Cisco Call Manager is vulnerable to a heap overflow, which causes a denial of service and allows remote code execution.
Discoverer: IBM ISS X-Force

 

ISS Coverage
Product Content Version
Network Sensor 7.0
Proventia A
Proventia IPS (G/GX)
Server Sensor 7.0
Proventia Multifunction Appliance
Proventia Server (Linux)		 1.95 or 24.56
Proventia Server (Windows)
Proventia Desktop		 x.x.x.1960
RealSecure Desktop 7.0 EQB
BlackICE PC Protection 3.6 CQB
Propagation Techniques ISS Protection Available
remote exploit Voip_Control_Channel_BO
 Feb. 15, 2007

Detailed Description
Business Impact: Compromise of machines using affected versions of Cisco Call Manager may lead to exposure of confidential information, loss of productivity, and further compromise. Successful exploitation of this vulnerability results in remote code execution and does not require user interaction.
CVSS: Base Score: 10.0
  Access Vector: Remote
Access Complexity: Low
Authentication: Not Required
Confidentiality Impact: Complete
Integrity Impact: Complete
Availability Impact: Complete
Impact Bias: Normal 
Adjusted Temporal Score: 7.4
  Exploitability: Unproven
Remediation Level: Official Fix
Report Confidence: Confirmed 
Affected Products: For a full list of affected versions, see XFDB references below.
Technical Description: Cisco Call Manager is the software-based call processing component of Cisco’s Voice Over IP (VoIP) infrastructure and is a critical component in any Cisco VoIP deployment. Cisco Call Manager is vulnerable to an integer overflow allowing a heap buffer overflow within the RisDC.exe component.  Exploiting this component compromises the Real-Time Information Server (RIS) data collector portion of the Call Manager SNMP infrastructure.  By sending specially-crafted packets, an attacker is able to trigger the integer overflow allowing a heap buffer overflow, which causes both a denial of service condition and enables the attacker to compromise the Call Manager server.
Remediation:

Patches are available for this issue. See References for details.

References
XFDB http://xforce.iss.net/xforce/xfdb/19057
Cisco http://www.cisco.com/warp/public/707/cisco-sa-20070711-cucm.shtml

Revision History
1.0 Initial publication.


About IBM Internet Security Systems
IBM Internet Security Systems is the trusted security advisor to thousands of the world's leading businesses and governments, providing pre-emptive protection for networks, desktops and servers. An established leader in security since 1994, the IBM Proventia® integrated security platform is designed to automatically protect against both known and unknown threats, helping to keep networks up and running and shielding customers from online attacks before they impact business assets. IBM Internet Security Systems products and services are based on the proactive security intelligence of its X-Force® research and development team – the unequivocal world authority in vulnerability and threat research. The Internet Security Systems product line is also complemented by comprehensive Managed Security Services and Professional Security Services. For more information, visit the Internet Security Systems Web site at www.iss.net or call 800-776-2362.