Details of VAR-201903-0573

ID

VAR-201903-0573

CVE

CVE-2019-1766

TITLE

Cisco IP Phone 8800 Input validation vulnerability in the series

Trust: 0.8

sources: JVNDB: JVNDB-2019-003061

DESCRIPTION

A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could allow an unauthenticated, remote attacker to cause high disk utilization, resulting in a denial of service (DoS) condition. The vulnerability exists because the affected software does not restrict the maximum size of certain files that can be written to disk. An attacker who has valid administrator credentials for an affected system could exploit this vulnerability by sending a crafted, remote connection request to an affected system. A successful exploit could allow the attacker to write a file that consumes most of the available disk space on the system, causing application functions to operate abnormally and leading to a DoS condition. This vulnerability affects Cisco IP Phone 8800 Series products running a SIP Software release prior to 12.5(1)SR1. This issue is tracked by Cisco Bug ID CSCvo58440

Trust: 1.89

sources: NVD: CVE-2019-1766 // JVNDB: JVNDB-2019-003061 // BID: 107498

AFFECTED PRODUCTS

vendor:	cisco	model:	ip phone 8800	scope:	lt	version:	12.5\(1\)sr1	Trust: 1.0
vendor:	cisco	model:	ip phone 8800 series	scope:	lt	version:	12.5(1)sr1	Trust: 0.8
vendor:	cisco	model:	ip phone series	scope:	eq	version:	880012.5(1)	Trust: 0.3
vendor:	cisco	model:	ip phone series 12.1 sr2.1	scope:	eq	version:	8800	Trust: 0.3
vendor:	cisco	model:	ip phone series	scope:	eq	version:	880012.1(1)	Trust: 0.3
vendor:	cisco	model:	ip phone series	scope:	eq	version:	880011.0(1)	Trust: 0.3
vendor:	cisco	model:	ip phone series	scope:	eq	version:	880011.0(0.1)	Trust: 0.3
vendor:	cisco	model:	ip phone series 11.0 mp2.62	scope:	eq	version:	8800	Trust: 0.3
vendor:	cisco	model:	ip phone series 11.0 mp2.153	scope:	eq	version:	8800	Trust: 0.3
vendor:	cisco	model:	ip phone series 11.0 mp2.120	scope:	eq	version:	8800	Trust: 0.3
vendor:	cisco	model:	ip phone series 11.0 mp2.100	scope:	eq	version:	8800	Trust: 0.3
vendor:	cisco	model:	ip phone series	scope:	eq	version:	880011.0	Trust: 0.3
vendor:	cisco	model:	ip phone series 12.5 sr1	scope:	ne	version:	8800	Trust: 0.3

sources: BID: 107498 // JVNDB: JVNDB-2019-003061 // NVD: CVE-2019-1766

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-1766
value:	HIGH
Trust: 1.0
ykramarz@cisco.com:	CVE-2019-1766
value:	HIGH
Trust: 1.0
NVD:	CVE-2019-1766
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201903-693
value:	HIGH
Trust: 0.6

nvd@nist.gov:	CVE-2019-1766
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8

ykramarz@cisco.com:	CVE-2019-1766
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.0
Trust: 1.8
nvd@nist.gov:	CVE-2019-1766
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.1
Trust: 1.0

sources: JVNDB: JVNDB-2019-003061 // CNNVD: CNNVD-201903-693 // NVD: CVE-2019-1766 // NVD: CVE-2019-1766

PROBLEMTYPE DATA

problemtype:

CWE-20

Trust: 1.8

sources: JVNDB: JVNDB-2019-003061 // NVD: CVE-2019-1766

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201903-693

TYPE

input validation

Trust: 0.6

sources: CNNVD: CNNVD-201903-693

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-003061

PATCH

title:	cisco-sa-20190320-ipfudos	url:	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190320-ipfudos	Trust: 0.8
title:	Cisco IP Phone 8800 Series Session Initiation Protocol Fixes for software input validation vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=90246	Trust: 0.6

sources: JVNDB: JVNDB-2019-003061 // CNNVD: CNNVD-201903-693

EXTERNAL IDS

db:	NVD	id:	CVE-2019-1766	Trust: 2.7
db:	JVNDB	id:	JVNDB-2019-003061	Trust: 0.8
db:	CNNVD	id:	CNNVD-201903-693	Trust: 0.6
db:	BID	id:	107498	Trust: 0.3

sources: BID: 107498 // JVNDB: JVNDB-2019-003061 // CNNVD: CNNVD-201903-693 // NVD: CVE-2019-1766

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190320-ipfudos	Trust: 1.9
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-1766	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2019-1766	Trust: 0.8
url:	http://www.cisco.com/	Trust: 0.3

sources: BID: 107498 // JVNDB: JVNDB-2019-003061 // CNNVD: CNNVD-201903-693 // NVD: CVE-2019-1766

CREDITS

David Gullasch of modzero AG .

Trust: 0.6

sources: CNNVD: CNNVD-201903-693

SOURCES

db:	BID	id:	107498
db:	JVNDB	id:	JVNDB-2019-003061
db:	CNNVD	id:	CNNVD-201903-693
db:	NVD	id:	CVE-2019-1766

LAST UPDATE DATE

2024-11-23T22:55:38.583000+00:00

SOURCES UPDATE DATE

db:	BID	id:	107498	date:	2019-03-20T00:00:00
db:	JVNDB	id:	JVNDB-2019-003061	date:	2019-05-08T00:00:00
db:	CNNVD	id:	CNNVD-201903-693	date:	2019-03-21T00:00:00
db:	NVD	id:	CVE-2019-1766	date:	2024-11-21T04:37:19.770

SOURCES RELEASE DATE

db:	BID	id:	107498	date:	2019-03-20T00:00:00
db:	JVNDB	id:	JVNDB-2019-003061	date:	2019-05-08T00:00:00
db:	CNNVD	id:	CNNVD-201903-693	date:	2019-03-20T00:00:00
db:	NVD	id:	CVE-2019-1766	date:	2019-03-22T20:29:00.510