Sign-up

ID

VAR-201702-0814


CVE

CVE-2017-3790


TITLE

Cisco Expressway Series and TelePresence Video Communication Server Vulnerability caused by system reload in software

Trust: 0.8

sources: JVNDB: JVNDB-2017-001720

DESCRIPTION

A vulnerability in the received packet parser of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) software could allow an unauthenticated, remote attacker to cause a reload of the affected system, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient size validation of user-supplied data. An attacker could exploit this vulnerability by sending crafted H.224 data in Real-Time Transport Protocol (RTP) packets in an H.323 call. An exploit could allow the attacker to overflow a buffer in a cache that belongs to the received packet parser, which will result in a crash of the application, resulting in a DoS condition. All versions of Cisco Expressway Series Software and Cisco TelePresence VCS Software prior to version X8.8.2 are vulnerable. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. Cisco Bug IDs: CSCus99263

Trust: 2.61

sources: NVD: CVE-2017-3790 // JVNDB: JVNDB-2017-001720 // CNVD: CNVD-2017-01332 // BID: 95786 // VULHUB: VHN-111993 // VULMON: CVE-2017-3790

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2017-01332

AFFECTED PRODUCTS

vendor:ciscomodel:expresswayscope:eqversion:x8.1.1

Trust: 1.9

vendor:ciscomodel:expresswayscope:eqversion:x8.5_base

Trust: 1.6

vendor:ciscomodel:telepresence video communication serverscope:eqversion:x7.1_base

Trust: 1.6

vendor:ciscomodel:telepresence video communication serverscope:eqversion:x7.2.2

Trust: 1.6

vendor:ciscomodel:expresswayscope:eqversion:x8.7.3

Trust: 1.6

vendor:ciscomodel:expresswayscope:eqversion:x8.6.0

Trust: 1.6

vendor:ciscomodel:expresswayscope:eqversion:x8.7.1

Trust: 1.6

vendor:ciscomodel:expresswayscope:eqversion:x8.5

Trust: 1.6

vendor:ciscomodel:expresswayscope:eqversion:x8.5.1

Trust: 1.6

vendor:ciscomodel:telepresence video communication serverscope:eqversion:x5.2_base

Trust: 1.6

vendor:ciscomodel:expresswayscope:eqversion:x8.5.2

Trust: 1.3

vendor:ciscomodel:expresswayscope:eqversion:x8.2.2

Trust: 1.3

vendor:ciscomodel:expresswayscope:eqversion:x8.2.1

Trust: 1.3

vendor:ciscomodel:expresswayscope:eqversion:x8.1.2

Trust: 1.3

vendor:ciscomodel:expresswayscope:eqversion:x8.7.0

Trust: 1.0

vendor:ciscomodel:telepresence video communication serverscope:eqversion:x7.2.1

Trust: 1.0

vendor:ciscomodel:telepresence video communication serverscope:eqversion:x7.0.0

Trust: 1.0

vendor:ciscomodel:telepresence video communication serverscope:eqversion:x7.0.3

Trust: 1.0

vendor:ciscomodel:expresswayscope:eqversion:x8.1.0

Trust: 1.0

vendor:ciscomodel:telepresence video communication serverscope:eqversion:x7.0.2

Trust: 1.0

vendor:ciscomodel:expresswayscope:eqversion:x8.6.1

Trust: 1.0

vendor:ciscomodel:expresswayscope:eqversion:x8.7.2

Trust: 1.0

vendor:ciscomodel:telepresence video communication serverscope:eqversion:x7.2.0

Trust: 1.0

vendor:ciscomodel:expresswayscope:eqversion:x8.5.3

Trust: 1.0

vendor:ciscomodel:expresswayscope:eqversion:x8.8.0

Trust: 1.0

vendor:ciscomodel:expresswayscope:eqversion:x8.2_base

Trust: 1.0

vendor:ciscomodel:telepresence video communication serverscope:eqversion:x6.0_base

Trust: 1.0

vendor:ciscomodel:expresswayscope:eqversion:x8.1_base

Trust: 1.0

vendor:ciscomodel:expresswayscope:eqversion:x8.5.0

Trust: 1.0

vendor:ciscomodel:expresswayscope:eqversion:x8.8.1

Trust: 1.0

vendor:ciscomodel:telepresence video communication serverscope:eqversion:x6.1_base

Trust: 1.0

vendor:ciscomodel:telepresence video communication serverscope:eqversion:x7.0.1

Trust: 1.0

vendor:ciscomodel:expressway softwarescope:ltversion:8.8.2

Trust: 0.8

vendor:ciscomodel:telepresence video communication server softwarescope:ltversion:8.8.2

Trust: 0.8

vendor:ciscomodel:expressway series softwarescope:ltversion:x8.8.2

Trust: 0.6

vendor:ciscomodel:telepresence vcs softwarescope:ltversion:x8.8.2

Trust: 0.6

vendor:ciscomodel:telepresence video communication server expresswayscope:eqversion:x8.5.2

Trust: 0.3

vendor:ciscomodel:telepresence video communication server expresswayscope:eqversion:x8.2.1

Trust: 0.3

vendor:ciscomodel:telepresence video communication server expresswayscope:eqversion:x8.2

Trust: 0.3

vendor:ciscomodel:telepresence video communication server expresswayscope:eqversion:x8.1.1

Trust: 0.3

vendor:ciscomodel:telepresence video communication server expresswayscope:eqversion:x8.1

Trust: 0.3

vendor:ciscomodel:expresswayscope:eqversion:x8.2

Trust: 0.3

vendor:ciscomodel:expresswayscope:eqversion:x8.1

Trust: 0.3

vendor:ciscomodel:telepresence video communication server expresswayscope:neversion:x8.8.2

Trust: 0.3

vendor:ciscomodel:expresswayscope:neversion:x8.8.2

Trust: 0.3

sources: CNVD: CNVD-2017-01332 // BID: 95786 // JVNDB: JVNDB-2017-001720 // CNNVD: CNNVD-201702-068 // NVD: CVE-2017-3790

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-3790
value: HIGH

Trust: 1.0

NVD: CVE-2017-3790
value: HIGH

Trust: 0.8

CNVD: CNVD-2017-01332
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201702-068
value: HIGH

Trust: 0.6

VULHUB: VHN-111993
value: HIGH

Trust: 0.1

VULMON: CVE-2017-3790
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2017-3790
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2017-01332
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-111993
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2017-3790
baseSeverity: HIGH
baseScore: 8.6
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 4.0
version: 3.0

Trust: 1.8

sources: CNVD: CNVD-2017-01332 // VULHUB: VHN-111993 // VULMON: CVE-2017-3790 // JVNDB: JVNDB-2017-001720 // CNNVD: CNNVD-201702-068 // NVD: CVE-2017-3790

PROBLEMTYPE DATA

problemtype:CWE-399

Trust: 1.9

problemtype:CWE-119

Trust: 1.1

problemtype:CWE-20

Trust: 1.1

sources: VULHUB: VHN-111993 // JVNDB: JVNDB-2017-001720 // NVD: CVE-2017-3790

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201702-068

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-201702-068

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-001720

PATCH
title:cisco-sa-20170125-expresswayurl:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170125-expressway
Trust: 0.8
title:Patch for Cisco ExpresswaySeries and Cisco TelePresenceVCS Denial of Service Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/89279
Trust: 0.6
title:Cisco Expressway Series Software  and Cisco TelePresence VCS Software Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=67454
Trust: 0.6
title:Threatposturl:https://threatpost.com/cisco-warns-of-critical-flaw-in-teleconferencing-gear/123435/
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2017-01332 // 
            
            
            
            VULMON: CVE-2017-3790 // 
            
            
            
            JVNDB: JVNDB-2017-001720 // 
            
            
            
            CNNVD: CNNVD-201702-068

EXTERNAL IDS
db:NVDid:CVE-2017-3790
Trust: 3.5
db:BIDid:95786
Trust: 2.7
db:SECTRACKid:1037697
Trust: 1.8
db:JVNDBid:JVNDB-2017-001720
Trust: 0.8
db:CNNVDid:CNNVD-201702-068
Trust: 0.7
db:CNVDid:CNVD-2017-01332
Trust: 0.6
db:VULHUBid:VHN-111993
Trust: 0.1
db:VULMONid:CVE-2017-3790
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2017-01332 // 
            
            
            
            VULHUB: VHN-111993 // 
            
            
            
            VULMON: CVE-2017-3790 // 
            
            
            
            BID: 95786 // 
            
            
            
            JVNDB: JVNDB-2017-001720 // 
            
            
            
            CNNVD: CNNVD-201702-068 // 
            
            
            
            NVD: CVE-2017-3790

REFERENCES
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20170125-expressway
Trust: 2.7
url:http://www.securityfocus.com/bid/95786
Trust: 1.8
url:http://www.securitytracker.com/id/1037697
Trust: 1.8
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-3790
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2017-3790
Trust: 0.8
url:http://www.cisco.com/
Trust: 0.3
url:https://cwe.mitre.org/data/definitions/119.html
Trust: 0.1
url:https://cwe.mitre.org/data/definitions/20.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://threatpost.com/cisco-warns-of-critical-flaw-in-teleconferencing-gear/123435/
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2017-01332 // 
            
            
            
            VULHUB: VHN-111993 // 
            
            
            
            VULMON: CVE-2017-3790 // 
            
            
            
            BID: 95786 // 
            
            
            
            JVNDB: JVNDB-2017-001720 // 
            
            
            
            CNNVD: CNNVD-201702-068 // 
            
            
            
            NVD: CVE-2017-3790

CREDITS
Cisco
Trust: 0.3
sources:
            
            
            BID: 95786

SOURCES
db:CNVDid:CNVD-2017-01332
db:VULHUBid:VHN-111993
db:VULMONid:CVE-2017-3790
db:BIDid:95786
db:JVNDBid:JVNDB-2017-001720
db:CNNVDid:CNNVD-201702-068
db:NVDid:CVE-2017-3790

LAST UPDATE DATE
2024-11-23T22:45:46.487000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2017-01332date:2017-02-14T00:00:00
db:VULHUBid:VHN-111993date:2019-10-03T00:00:00
db:VULMONid:CVE-2017-3790date:2019-10-03T00:00:00
db:BIDid:95786date:2017-02-02T06:01:00
db:JVNDBid:JVNDB-2017-001720date:2017-03-15T00:00:00
db:CNNVDid:CNNVD-201702-068date:2019-10-23T00:00:00
db:NVDid:CVE-2017-3790date:2024-11-21T03:26:07.160

SOURCES RELEASE DATE
db:CNVDid:CNVD-2017-01332date:2017-02-14T00:00:00
db:VULHUBid:VHN-111993date:2017-02-01T00:00:00
db:VULMONid:CVE-2017-3790date:2017-02-01T00:00:00
db:BIDid:95786date:2017-01-25T00:00:00
db:JVNDBid:JVNDB-2017-001720date:2017-03-15T00:00:00
db:CNNVDid:CNNVD-201702-068date:2017-02-06T00:00:00
db:NVDid:CVE-2017-3790date:2017-02-01T19:59:00.190