The kernel in Cisco Native Unix (CNU) on Cisco Unified IP Phone 7900 series devices (aka TNP phones) with software before 9.3.1-ES10 does not properly validate unspecified system calls, which allows attackers to execute arbitrary code or cause a denial of service (memory overwrite) via a crafted binary.
Vector
LOCAL
Complexity
LOW
Authentication
SINGLE_INSTANCE
Confidentiality
COMPLETE
Integrity
COMPLETE
Availability
COMPLETE
Cisco AP1240
Cisco AnyConnect Secure Mobility Client 2.5.3041
Cisco AnyConnect Secure Mobility Client 2.1
Cisco AnyConnect Secure Mobility Client
Cisco AnyConnect Secure Mobility Client 2.4.0202
Cisco Aironet 1400
Cisco AnyConnect Secure Mobility Client 3.0.0629
Cisco AnyConnect Secure Mobility Client 3.0.08057
Cisco Airespace 4000 Series Wireless LAN Controller
Cisco AnyConnect Secure Mobility Client 2.4.7073 for Android
Cisco AnyConnect Secure Mobility Client 2.2.133
Cisco Skinny client control protocol software 9.0(3b) (not an official CPE)
Cisco Adaptive Security Appliance (ASA) Software 9.2.2.8
Cisco Adaptive Security Appliance (ASA) Software 9.3(3)
Cisco Adaptive Security Device Manager Idm Launcher 1.5.45
Cisco Aironet 3600i
Cisco Adaptive Security Appliance (ASA) Software 9.1.5.15
Cisco AnyConnect Secure Mobility Client 2.3.2016
Cisco Aironet AP340
Cisco AnyConnect Secure Mobility Client 2.4.5004 for Symbian OS
Cisco Skinny client control protocol software 9.2(4) (not an official CPE)
Cisco AnyConnect Secure Mobility Client 2.2
Cisco Adaptive Security Appliance (ASA) Software 9.2.3
Cisco AnyConnect Secure Mobility Client 3.0
Cisco Adaptive Security Appliance (ASA) Software 9.3(2.243)
Cisco AnyConnect Secure Mobility Client 2.4.7030 for Android
Cisco Adaptive Security Appliance (ASA) Software 9.3.2.2
Cisco Airespace 6500
Cisco Adaptive Security Device Manager Idm Launcher 1.5.41
Cisco Skinny client control protocol software 9.1(1) (not an official CPE)
Cisco AnyConnect Secure Mobility Client 2.5.2001
Cisco Adaptive Security Appliance (ASA) Software 9.3.1.1
Cisco Aironet 1230AG
Cisco Aironet 1300
Cisco Aironet Access Point 340 11.21
Cisco AnyConnect Secure Mobility Client 3.0.1047
Cisco AnyConnect Secure Mobility Client 3.0.3054
Cisco AnyConnect Secure Mobility Client 2.0
Cisco AnyConnect Secure Mobility Client 2.5.0217
Cisco Agent Desktop 80.2.9
Cisco AnyConnect Secure Mobility Client 2.4
Cisco Adaptive Security Appliance (ASA) Software 9.1.5.21
Cisco Adaptive Security Device Manager Idm Launcher 1.5.49
Cisco AnyConnect Secure Mobility Client 2.4.1012
Cisco Adaptive Security Appliance (ASA) Software 9.3(.2)
Cisco Aironet 1200
Cisco Adaptive Security Appliance (ASA) Software 9.1.6
Cisco AnyConnect Secure Mobility Client for Mac OS X
Cisco AnyConnect Secure Mobility Client 3.0.5080
Cisco Aironet 350 IOS
Cisco Adaptive Security Appliance (ASA) Software 9.2.2.8
Cisco AnyConnect Secure Mobility Client 2.5.2018
Cisco AnyConnect Secure Mobility Client 2.5
Cisco Adaptive Security Appliance (ASA) Software 9.2.2.4
Cisco Aironet 1140
Cisco AnyConnect Secure Mobility Client 3.0.07059
Cisco Adaptive Security Appliance (ASA) Software 9.2(3.1)
Cisco Adaptive Security Appliance (ASA) Software 9.1.5.21
Cisco Adaptive Security Device Manager Idm Launcher 1.5.47
Cisco Skinny client control protocol software 9.2(2) (not an official CPE)
Cisco AnyConnect Secure Mobility Client 2.4.4004 for iPhone OS
Cisco Adaptive Security Appliance (ASA) Software 9.2.3.3
Cisco AP1131
Cisco Anomaly Guard Module 5.0(1)
Cisco Aironet 1040
Cisco Aironet 1260
Cisco Adaptive Security Device Manager Idm Launcher 1.5.50
Cisco Aironet 1130AG
Cisco AnyConnect Secure Mobility Client 2.4.4014 for iPhone OS
Cisco Adaptive Security Appliance (ASA) Software 9.3.2.2
Cisco Adaptive Security Appliance (ASA) Software 9.1.4.5
Cisco AnyConnect Secure Mobility Client 2.5.2014
Cisco AnyConnect Secure Mobility Client 2.2.136
Cisco AnyConnect Secure Mobility Client 2.5.5118 for Android
Cisco AnyConnect Secure Mobility Client 2.5.2010
Cisco Adaptive Security Appliance (ASA) Software 9.1.5.12
Cisco AnyConnect Secure Mobility Client 3.0.5075
Cisco AnyConnect Secure Mobility Client 2.4 for Symbian OS
Cisco Adaptive Security Device Manager Launcher 1.5.24
Cisco Aironet 600 Office Extend
Cisco AnyConnect Secure Mobility Client 2.5.2019
Cisco AnyConnect Secure Mobility Client 2.5.1025
Cisco Aironet Access Point 350 11.21
Cisco AnyConnect Secure Mobility Client 3.0.4235
Cisco AnyConnect Secure Mobility Client 3.0.08066
Cisco AnyConnect Secure Mobility Client 2.5.5112 for iPhone OS
Cisco Adaptive Security Appliance (ASA) Software 9.2.1
Cisco AnyConnect Secure Mobility Client 2.5.3055
Cisco AnyConnect Secure Mobility Client 2.5.3054
Cisco Aironet 1100
Cisco Aironet 3500
Cisco Adaptive Security Device Manager Launcher 1.5.20
Cisco Adaptive Security Appliance (ASA) Software 9.1.5.10
Cisco AnyConnect Secure Mobility Client 3.0.3050
Cisco Skinny client control protocol software 9.2(1) (not an official CPE)
Cisco AnyConnect Secure Mobility Client 2.2.128
Cisco AnyConnect Secure Mobility Client 3.0.08057 (Maintenance Release 8 / MR8) (x64) 64-bit
Cisco AnyConnect Secure Mobility Client 2.5.3051
Cisco AnyConnect Secure Mobility Client 2.5.3046
Cisco AnyConnect Secure Mobility Client 3.0 (x64) 64-bit
Cisco Adaptive Security Device Manager Launcher 1.5.30
Cisco AnyConnect Secure Mobility Client 2.5.2006
Cisco AnyConnect Secure Mobility Client 2.3.254
Cisco Adaptive Security Appliance (ASA) Software 9.3(1.50)
Cisco Anomaly Guard Module
Cisco Aironet Bridge 350
Cisco Adaptive Security Appliance (ASA) Software 9.2.2.7
Cisco Adaptive Security Appliance (ASA) Software 9.1.5.12
Cisco Adaptive Security Appliance (ASA) Software 9.2.2
Cisco AnyConnect Secure Mobility Client 3.0.2052
Cisco AnyConnect Secure Mobility Client 2.5.5125 for Android
Cisco Adaptive Security Appliance (ASA) Software 9.1.5
Cisco Adaptive Security Appliance (ASA) Software 9.3.2
Cisco AnyConnect Secure Mobility Client 2.5.6005
Cisco Aironet 3600P
Cisco Aironet 3600
Cisco Adaptive Security Device Manager Idm Launcher 1.5.31
Cisco AnyConnect Secure Mobility Client 2.3
Cisco Adaptive Security Appliance (ASA) Software 9.3.1.1
Cisco Skinny client control protocol software 9.1(1) Sr1 (not an official CPE)
Cisco Agent Desktop
Cisco Skinny client control protocol software 9.1(1) Sr2 (not an official CPE)
Cisco Anomaly Guard Module 5.0(3)
Cisco Adaptive Security Appliance (ASA) Software 9.2.2.7
Cisco Adaptive Security Appliance (ASA) Software 9.1.4.5
Cisco Aironet 3600e
Cisco Adaptive Security Appliance (ASA) Software 9.4(1)
Cisco Adaptive Security Appliance (ASA) Software 9.3.2
Cisco AnyConnect Secure Mobility Client 2.5.5130 for iPhone OS
Cisco AnyConnect Secure Mobility Client 2.5.5131 for Android
Cisco Adaptive Security Appliance (ASA) Software 9.4(1.1)
Cisco Aironet 1240AG
Cisco AnyConnect Secure Mobility Client 2.5.2011
Cisco AnyConnect Secure Mobility Client 2.5.2017
Cisco AnyConnect Secure Mobility Client 2.3.185
Cisco AnyConnect Secure Mobility Client 2.2.140
Cisco Adaptive Security Appliance (ASA) Software 9.3.1
Cisco AIR-CT5760
Cisco AnyConnect Secure Mobility Client 2.5.5116 for Android
Cisco Unified ip phone 7911g (not an official CPE)
Cisco Unified ip phone 7906g 7970g (not an official CPE)
Cisco Unified ip phone 7961g (not an official CPE)
Cisco Unified ip phone 7906g 7971g (not an official CPE)
Cisco Unified ip phone 7960g (not an official CPE)
Cisco Unified ip phone 7906g 7911g (not an official CPE)
Cisco Unified ip phone 7970g (not an official CPE)
Cisco Unified ip phone 7960 (not an official CPE)
Cisco Unified ip phone 7906g (not an official CPE)
Cisco Unified ip phone 7971g (not an official CPE)
Cisco Unified ip phone 7936 (not an official CPE)
Cisco Unified ip phone 7935 (not an official CPE)
Cisco Unified ip phone 7940g (not an official CPE)
Cisco Unified ip phone 7940 (not an official CPE)
Cisco Unified ip phone 7906g 7961g (not an official CPE)
Cisco Unified ip phone 7906g 7941g (not an official CPE)
Cisco Unified ip phone 7941g (not an official CPE)
| Advisory | Patch | Confirmed | Link |
|---|---|---|---|
| 20130109 Cisco Unified IP Phones Local Kernel System Cal... | |||
| http://events.ccc.de/congress/2012/Fahrplan/events/5400.... |
Improper Input Validation (ID 20)
Related CAPEC 58
Buffer Overflow via Environment Variables (CAPEC-ID 10)
Server Side Include (SSI) Injection (CAPEC-ID 101)
Cross Zone Scripting (CAPEC-ID 104)
Cross Site Scripting through Log Files (CAPEC-ID 106)
Command Line Execution through SQL Injection (CAPEC-ID 108)
Object Relational Mapping Injection (CAPEC-ID 109)
SQL Injection through SOAP Parameter Tampering (CAPEC-ID 110)
Subverting Environment Variable Values (CAPEC-ID 13)
Format String Injection (CAPEC-ID 135)
LDAP Injection (CAPEC-ID 136)
Relative Path Traversal (CAPEC-ID 139)
Client-side Injection-induced Buffer Overflow (CAPEC-ID 14)
Variable Manipulation (CAPEC-ID 171)
Embedding Scripts in Non-Script Elements (CAPEC-ID 18)
Flash Injection (CAPEC-ID 182)
Cross-Site Scripting Using Alternate Syntax (CAPEC-ID 199)
Exploiting Trust in Client (aka Make the Client Invisible) (CAPEC-ID 22)
XML Nested Payloads (CAPEC-ID 230)
XML Oversized Payloads (CAPEC-ID 231)
Filter Failure through Buffer Overflow (CAPEC-ID 24)
Cross-Site Scripting via Encoded URI Schemes (CAPEC-ID 244)
XML Injection (CAPEC-ID 250)
Environment Variable Manipulation (CAPEC-ID 264)
Global variable manipulation (CAPEC-ID 265)
Leverage Alternate Encoding (CAPEC-ID 267)
Fuzzing (CAPEC-ID 28)
Using Leading 'Ghost' Character Sequences to Bypass Input Filters (CAPEC-ID 3)
Accessing/Intercepting/Modifying HTTP Cookies (CAPEC-ID 31)
Embedding Scripts in HTTP Query Strings (CAPEC-ID 32)
MIME Conversion (CAPEC-ID 42)
Exploiting Multiple Input Interpretation Layers (CAPEC-ID 43)
Buffer Overflow via Symbolic Links (CAPEC-ID 45)
Overflow Variables and Tags (CAPEC-ID 46)
Buffer Overflow via Parameter Expansion (CAPEC-ID 47)
Signature Spoof (CAPEC-ID 473)
XML Client-Side Attack (CAPEC-ID 484)
Embedding NULL Bytes (CAPEC-ID 52)
Postfix, Null Terminate, and Backslash (CAPEC-ID 53)
Simple Script Injection (CAPEC-ID 63)
Using Slashes and URL Encoding Combined to Bypass Validation Logic (CAPEC-ID 64)
SQL Injection (CAPEC-ID 66)
String Format Overflow in syslog() (CAPEC-ID 67)
Blind SQL Injection (CAPEC-ID 7)
Using Unicode Encoding to Bypass Validation Logic (CAPEC-ID 71)
URL Encoding (CAPEC-ID 72)
User-Controlled Filename (CAPEC-ID 73)
Using Escaped Slashes in Alternate Encoding (CAPEC-ID 78)
Using Slashes in Alternate Encoding (CAPEC-ID 79)
Buffer Overflow in an API Call (CAPEC-ID 8)
Using UTF-8 Encoding to Bypass Validation Logic (CAPEC-ID 80)
Web Logs Tampering (CAPEC-ID 81)
XPath Injection (CAPEC-ID 83)
AJAX Fingerprinting (CAPEC-ID 85)
Embedding Script (XSS) in HTTP Headers (CAPEC-ID 86)
OS Command Injection (CAPEC-ID 88)
Buffer Overflow in Local Command-Line Utilities (CAPEC-ID 9)
XSS in IMG Tags (CAPEC-ID 91)
XML Parser Attack (CAPEC-ID 99)