var-201904-0244
Vulnerability from variot
A vulnerability in the phone book feature of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to cause the CPU to increase to 100% utilization, causing a denial of service (DoS) condition on an affected system. The vulnerability is due to improper handling of the XML input. An attacker could exploit this vulnerability by sending a Session Initiation Protocol (SIP) message with a crafted XML payload to an affected device. A successful exploit could allow the attacker to exhaust CPU resources, resulting in a DoS condition. Manual intervention may be required to recover the device. This vulnerability is fixed in Cisco Expressway Series and Cisco TelePresence Video Communication Server Releases X12.5.1 and later. This issue is being tracked by Cisco Bug ID CSCvn99037
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-201904-0244", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "telepresence video communication server", "scope": "lt", "trust": 1.0, "vendor": "cisco", "version": "x12.5.1" }, { "model": "telepresence video communication server software", "scope": null, "trust": 0.8, "vendor": "cisco", "version": null }, { "model": "telepresence video communication server", "scope": "eq", "trust": 0.6, "vendor": "cisco", "version": "x8.5.2" }, { "model": "telepresence video communication server", "scope": "eq", "trust": 0.6, "vendor": "cisco", "version": "x8.1.1" }, { "model": "telepresence video communication server", "scope": "eq", "trust": 0.3, "vendor": "cisco", "version": "x8.8.3" }, { "model": "telepresence video communication server", "scope": "eq", "trust": 0.3, "vendor": "cisco", "version": "x8.7.2" }, { "model": "telepresence video communication server", "scope": "eq", "trust": 0.3, "vendor": "cisco", "version": "x8.5.1" }, { "model": "telepresence video communication server", "scope": "eq", "trust": 0.3, "vendor": "cisco", "version": "x8.2" }, { "model": "telepresence video communication server", "scope": "eq", "trust": 0.3, "vendor": "cisco", "version": "x8.1" }, { "model": "telepresence video communication server", "scope": "eq", "trust": 0.3, "vendor": "cisco", "version": "x8" }, { "model": "telepresence video communication server", "scope": "eq", "trust": 0.3, "vendor": "cisco", "version": "x7.2.3" }, { "model": "telepresence video communication server", "scope": "eq", "trust": 0.3, "vendor": "cisco", "version": "x7.2.2" }, { "model": "telepresence video communication server", "scope": "eq", "trust": 0.3, "vendor": "cisco", "version": "x7.2.1" }, { "model": "telepresence video communication server", "scope": "eq", "trust": 0.3, "vendor": "cisco", "version": "x7.2" }, { "model": "telepresence video communication server", "scope": "eq", "trust": 0.3, "vendor": "cisco", "version": "x7.1" }, { "model": "telepresence video communication server", "scope": "eq", "trust": 0.3, "vendor": "cisco", "version": "x7.0.3" }, { "model": "telepresence video communication server", "scope": "eq", "trust": 0.3, "vendor": "cisco", "version": "x7.0.1" }, { "model": "telepresence video communication server", "scope": "eq", "trust": 0.3, "vendor": "cisco", "version": "x7.0" }, { "model": "telepresence video communication server", "scope": "eq", "trust": 0.3, "vendor": "cisco", "version": "8.8" }, { "model": "telepresence video communication server", "scope": "eq", "trust": 0.3, "vendor": "cisco", "version": "8.5.1" }, { "model": "telepresence video communication server", "scope": "eq", "trust": 0.3, "vendor": "cisco", "version": "x8.6" }, { "model": "telepresence video communication server", "scope": "eq", "trust": 0.3, "vendor": "cisco", "version": "x6.0.2" }, { "model": "telepresence video communication server", "scope": "eq", "trust": 0.3, "vendor": "cisco", "version": "0" }, { "model": "expressway series", "scope": "eq", "trust": 0.3, "vendor": "cisco", "version": "x8.8.3" }, { "model": "expressway series", "scope": "eq", "trust": 0.3, "vendor": "cisco", "version": "x8.1.1" }, { "model": "expressway series", "scope": "eq", "trust": 0.3, "vendor": "cisco", "version": "x8.1" }, { "model": "expressway series", "scope": "eq", "trust": 0.3, "vendor": "cisco", "version": "8.8" }, { "model": "expressway series", "scope": "eq", "trust": 0.3, "vendor": "cisco", "version": "0" }, { "model": "telepresence video communication server", "scope": "ne", "trust": 0.3, "vendor": "cisco", "version": "x12.5.1" }, { "model": "expressway series", "scope": "ne", "trust": 0.3, "vendor": "cisco", "version": "x12.5.1" } ], "sources": [ { "db": "BID", "id": "108016" }, { "db": "JVNDB", "id": "JVNDB-2019-003532" }, { "db": "NVD", "id": "CVE-2019-1721" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:cisco:telepresence_video_communication_server:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "x12.5.1", "vulnerable": true } ], "operator": "OR" } ] } ], "sources": [ { "db": "NVD", "id": "CVE-2019-1721" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Cisco", "sources": [ { "db": "BID", "id": "108016" }, { "db": "CNNVD", "id": "CNNVD-201904-844" } ], "trust": 0.9 }, "cve": "CVE-2019-1721", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "acInsufInfo": false, "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "author": "NVD", "availabilityImpact": "COMPLETE", "baseScore": 6.8, "confidentialityImpact": "NONE", "exploitabilityScore": 8.0, "impactScore": 6.9, "integrityImpact": "NONE", "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "trust": 1.0, "userInteractionRequired": false, "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:C", "version": "2.0" }, { "acInsufInfo": null, "accessComplexity": "Low", "accessVector": "Network", "authentication": "Single", "author": "NVD", "availabilityImpact": "Complete", "baseScore": 6.8, "confidentialityImpact": "None", "exploitabilityScore": null, "id": "CVE-2019-1721", "impactScore": null, "integrityImpact": "None", "obtainAllPrivilege": null, "obtainOtherPrivilege": null, "obtainUserPrivilege": null, "severity": "Medium", "trust": 0.9, "userInteractionRequired": null, "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:C", "version": "2.0" }, { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "author": "VULHUB", "availabilityImpact": "COMPLETE", "baseScore": 6.8, "confidentialityImpact": "NONE", "exploitabilityScore": 8.0, "id": "VHN-149433", "impactScore": 6.9, "integrityImpact": "NONE", "severity": "MEDIUM", "trust": 0.1, "vectorString": "AV:N/AC:L/AU:S/C:N/I:N/A:C", "version": "2.0" } ], "cvssV3": [ { "attackComplexity": "LOW", "attackVector": "NETWORK", "author": "NVD", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "exploitabilityScore": 2.8, "impactScore": 3.6, "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "trust": 1.0, "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, { "attackComplexity": "LOW", "attackVector": "NETWORK", "author": "ykramarz@cisco.com", "availabilityImpact": "HIGH", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "exploitabilityScore": 3.1, "impactScore": 4.0, "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "trust": 1.0, "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H", "version": "3.0" }, { "attackComplexity": "Low", "attackVector": "Network", "author": "NVD", "availabilityImpact": "High", "baseScore": 6.5, "baseSeverity": "Medium", "confidentialityImpact": "None", "exploitabilityScore": null, "id": "CVE-2019-1721", "impactScore": null, "integrityImpact": "None", "privilegesRequired": "Low", "scope": "Unchanged", "trust": 0.8, "userInteraction": "None", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" } ], "severity": [ { "author": "NVD", "id": "CVE-2019-1721", "trust": 1.8, "value": "MEDIUM" }, { "author": "ykramarz@cisco.com", "id": "CVE-2019-1721", "trust": 1.0, "value": "HIGH" }, { "author": "CNNVD", "id": "CNNVD-201904-844", "trust": 0.6, "value": "MEDIUM" }, { "author": "VULHUB", "id": "VHN-149433", "trust": 0.1, "value": "MEDIUM" }, { "author": "VULMON", "id": "CVE-2019-1721", "trust": 0.1, "value": "MEDIUM" } ] } ], "sources": [ { "db": "VULHUB", "id": "VHN-149433" }, { "db": "VULMON", "id": "CVE-2019-1721" }, { "db": "JVNDB", "id": "JVNDB-2019-003532" }, { "db": "NVD", "id": "CVE-2019-1721" }, { "db": "NVD", "id": "CVE-2019-1721" }, { "db": "CNNVD", "id": "CNNVD-201904-844" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "A vulnerability in the phone book feature of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to cause the CPU to increase to 100% utilization, causing a denial of service (DoS) condition on an affected system. The vulnerability is due to improper handling of the XML input. An attacker could exploit this vulnerability by sending a Session Initiation Protocol (SIP) message with a crafted XML payload to an affected device. A successful exploit could allow the attacker to exhaust CPU resources, resulting in a DoS condition. Manual intervention may be required to recover the device. This vulnerability is fixed in Cisco Expressway Series and Cisco TelePresence Video Communication Server Releases X12.5.1 and later. \nThis issue is being tracked by Cisco Bug ID CSCvn99037", "sources": [ { "db": "NVD", "id": "CVE-2019-1721" }, { "db": "JVNDB", "id": "JVNDB-2019-003532" }, { "db": "BID", "id": "108016" }, { "db": "VULHUB", "id": "VHN-149433" }, { "db": "VULMON", "id": "CVE-2019-1721" } ], "trust": 2.07 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2019-1721", "trust": 2.9 }, { "db": "BID", "id": "108016", "trust": 2.1 }, { "db": "JVNDB", "id": "JVNDB-2019-003532", "trust": 0.8 }, { "db": "CNNVD", "id": "CNNVD-201904-844", "trust": 0.7 }, { "db": "AUSCERT", "id": "ESB-2019.1330.2", "trust": 0.6 }, { "db": "VULHUB", "id": "VHN-149433", "trust": 0.1 }, { "db": "VULMON", "id": "CVE-2019-1721", "trust": 0.1 } ], "sources": [ { "db": "VULHUB", "id": "VHN-149433" }, { "db": "VULMON", "id": "CVE-2019-1721" }, { "db": "BID", "id": "108016" }, { "db": "JVNDB", "id": "JVNDB-2019-003532" }, { "db": "NVD", "id": "CVE-2019-1721" }, { "db": "CNNVD", "id": "CNNVD-201904-844" } ] }, "id": "VAR-201904-0244", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "VULHUB", "id": "VHN-149433" } ], "trust": 0.01 }, "last_update_date": "2023-12-18T12:00:24.066000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "cisco-sa-20190417-es-tvcs-dos", "trust": 0.8, "url": "https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190417-es-tvcs-dos" }, { "title": "Cisco Expressway Series and Cisco TelePresence Video Communication Server Enter the fix for the verification error vulnerability", "trust": 0.6, "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=91678" }, { "title": "Cisco: Cisco Expressway Series and Cisco TelePresence Video Communication Server Denial of Service Vulnerability", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts\u0026qid=cisco-sa-20190417-es-tvcs-dos" }, { "title": "Threatpost", "trust": 0.1, "url": "https://threatpost.com/cisco_high-severity_bug/144410/" } ], "sources": [ { "db": "VULMON", "id": "CVE-2019-1721" }, { "db": "JVNDB", "id": "JVNDB-2019-003532" }, { "db": "CNNVD", "id": "CNNVD-201904-844" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-20", "trust": 1.1 }, { "problemtype": "CWE-399", "trust": 0.9 } ], "sources": [ { "db": "VULHUB", "id": "VHN-149433" }, { "db": "JVNDB", "id": "JVNDB-2019-003532" }, { "db": "NVD", "id": "CVE-2019-1721" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 2.5, "url": "http://www.securityfocus.com/bid/108016" }, { "trust": 2.2, "url": "https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190417-es-tvcs-dos" }, { "trust": 1.4, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-1721" }, { "trust": 0.9, "url": "http://www.cisco.com/" }, { "trust": 0.8, "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-1721" }, { "trust": 0.6, "url": "https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190417-ex-vcs-xsrf" }, { "trust": 0.6, "url": "https://www.auscert.org.au/bulletins/79282" }, { "trust": 0.1, "url": "https://cwe.mitre.org/data/definitions/20.html" }, { "trust": 0.1, "url": "https://nvd.nist.gov" }, { "trust": 0.1, "url": "https://threatpost.com/cisco_high-severity_bug/144410/" } ], "sources": [ { "db": "VULHUB", "id": "VHN-149433" }, { "db": "VULMON", "id": "CVE-2019-1721" }, { "db": "BID", "id": "108016" }, { "db": "JVNDB", "id": "JVNDB-2019-003532" }, { "db": "NVD", "id": "CVE-2019-1721" }, { "db": "CNNVD", "id": "CNNVD-201904-844" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "VULHUB", "id": "VHN-149433" }, { "db": "VULMON", "id": "CVE-2019-1721" }, { "db": "BID", "id": "108016" }, { "db": "JVNDB", "id": "JVNDB-2019-003532" }, { "db": "NVD", "id": "CVE-2019-1721" }, { "db": "CNNVD", "id": "CNNVD-201904-844" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2019-04-18T00:00:00", "db": "VULHUB", "id": "VHN-149433" }, { "date": "2019-04-18T00:00:00", "db": "VULMON", "id": "CVE-2019-1721" }, { "date": "2019-04-17T00:00:00", "db": "BID", "id": "108016" }, { "date": "2019-05-20T00:00:00", "db": "JVNDB", "id": "JVNDB-2019-003532" }, { "date": "2019-04-18T01:29:01.967000", "db": "NVD", "id": "CVE-2019-1721" }, { "date": "2019-04-17T00:00:00", "db": "CNNVD", "id": "CNNVD-201904-844" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2020-10-07T00:00:00", "db": "VULHUB", "id": "VHN-149433" }, { "date": "2020-10-07T00:00:00", "db": "VULMON", "id": "CVE-2019-1721" }, { "date": "2019-04-17T00:00:00", "db": "BID", "id": "108016" }, { "date": "2019-05-20T00:00:00", "db": "JVNDB", "id": "JVNDB-2019-003532" }, { "date": "2020-10-07T19:04:21.117000", "db": "NVD", "id": "CVE-2019-1721" }, { "date": "2020-10-28T00:00:00", "db": "CNNVD", "id": "CNNVD-201904-844" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "remote", "sources": [ { "db": "CNNVD", "id": "CNNVD-201904-844" } ], "trust": 0.6 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Cisco Expressway Series and TelePresence Video Communication Server Resource management vulnerability", "sources": [ { "db": "JVNDB", "id": "JVNDB-2019-003532" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Input Validation Error", "sources": [ { "db": "BID", "id": "108016" }, { "db": "CNNVD", "id": "CNNVD-201904-844" } ], "trust": 0.9 } }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.