-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256

Cisco Unified Communications Manager Session Initiation Protocol Denial of Service Vulnerability

Advisory ID: cisco-sa-20120926-cucm

Revision 1.0

For Public Release 2012 September 26 16:00 UTC (GMT) +---------------------------------------------------------------------

Summary =======

Cisco Unified Communications Manager contains a vulnerability in its Session Initiation Protocol (SIP) implementation that could allow an unauthenticated, remote attacker to cause a critical service to fail, which could interrupt voice services. Affected devices must be configured to process SIP messages for this vulnerability to be exploitable.

Cisco has released free software updates that address this vulnerability. A workaround exists for customers who do not require SIP in their environment.

This advisory is available at:

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-s...

Note: The September 26, 2012, Cisco IOS Software Security Advisory bundled publication includes 9 Cisco Security Advisories. Eight of the advisories address vulnerabilities in Cisco IOS Software, and one advisory addresses a vulnerability in Cisco Unified Communications Manager. Each Cisco IOS Software Security Advisory lists the Cisco IOS Software releases that correct the vulnerability or vulnerabilities detailed in the advisory as well as the Cisco IOS Software releases that correct all Cisco IOS Software vulnerabilities in the September 2012 bundled publication.

Individual publication links are in "Cisco Event Response: Semi-Annual Cisco IOS Software Security Advisory Bundled Publication" at the following link:

http://www.cisco.com/web/about/security/intelligence/Cisco_ERP_sep12.html

Cisco IOS Software and Cisco IOS XE Software are affected by the vulnerability described in this advisory. A separate Cisco Security Advisory has been published to disclose the vulnerability that affects Cisco IOS Software and Cisco IOS XE Software at the following location:

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-s...