Remote code execution in Cisco Meeting Server

1) Remote code execution

EUVDB-ID: #VU1139

Risk: High

CVSSv3.1: 8.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-6448

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote unauthenticated user to execute arbitrary code on the target system
The weakness is due to improper input validation. By sending a specially crafted Session Description Protocol (SDP) packets, a remote attacker can cayse a buffer overflow in the processing of media lines in the SDP parser and execute arbitrary code.
Successful exploitation of the vulnerability results in arbitrary code execution.

Mitigation

Update to version 2.0.3.

Vulnerable software versions

Cisco Meeting Server: 1.8 - 2.0.3

CPE2.3

• cpe:2.3:a:cisco_systems:cisco_meeting_server:2.0.3:*:*:*:*:*:*:*
• cpe:2.3:a:cisco_systems:cisco_meeting_server:2.0:*:*:*:*:*:*:*
• cpe:2.3:a:cisco_systems:cisco_meeting_server:1.9:*:*:*:*:*:*:*

External links

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161102-cms1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.