CVE-2017-6779 Denial of service in Multiple Cisco Products unknown
Unauthenticated remote attackers can cause denial of service by filling disk space via unbounded system log files in Cisco collaboration products.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-6779?
CVE-2017-6779 is a high-severity denial of service vulnerability in Cisco Unified Communications Manager, published on 7 Jun 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Multiple Cisco products are affected by a vulnerability in local file management for certain system log files of Cisco collaboration products that could allow an unauthenticated, remote attacker to cause high disk utilization, resulting in a denial of service (DoS) condition. The vulnerability occurs because a certain system log file does not have a maximum size restriction. Therefore, the file is allowed to consume the majority of available disk space on the appliance. An attacker could exploit this vulnerability by sending crafted remote connection requests to the appliance. Successful exploitation could allow the attacker to increase the size of a system log file so that it consumes most of the disk space. The lack of available disk space could lead to a DoS condition in which the application functions could operate abnormally, making the appliance unstable. This vulnerability affects the following Cisco Voice Operating System (VOS)-based products: Emergency Responder, Finesse, Hosted Collaboration Mediation Fulfillment, MediaSense, Prime License Manager, SocialMiner, Unified Communications Manager (UCM), Unified Communications Manager IM and Presence Service (IM&P - earlier releases were known as Cisco Unified Presence), Unified Communication Manager Session Management Edition (SME), Unified Contact Center Express (UCCx), Unified Intelligence Center (UIC), Unity Connection, Virtualized Voice Browser. This vulnerability also affects Prime Collaboration Assurance and Prime Collaboration Provisioning. Cisco Bug IDs: CSCvd10872, CSCvf64322, CSCvf64332, CSCvi29538, CSCvi29543, CSCvi29544, CSCvi29546, CSCvi29556, CSCvi29571, CSCvi31738, CSCvi31741, CSCvi31762, CSCvi31807, CSCvi31818, CSCvi31823.
Which versions are affected by CVE-2017-6779?
It affects 13 products.
Products include Cisco Emergency Responder, Cisco Finesse, Cisco Hosted Collaboration Mediation Fulfillment, Cisco Mediasense, Cisco Prime Collaboration Assurance, Cisco Prime Collaboration Provisioning and 7 more.
How do I fix CVE-2017-6779?
No fix has been published for CVE-2017-6779 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2017-6779 being exploited?
There is no known exploitation of CVE-2017-6779 in the wild and no public exploit code.
Other vulnerabilities in Cisco Unified Communications Manager
Sources
Also known as GHSA-jfgw-vvcr-pv6q.