High severity · published Jun 7, 2018
CVE-2017-6779
Multiple Cisco products are affected by a vulnerability in local file management for certain system log files of Cisco collaboration products that could allow an unauthenticated,…
7.5
CVSS
2%
EPSS
No
On KEV
Description
Multiple Cisco products are affected by a vulnerability in local file management for certain system log files of Cisco collaboration products that could allow an unauthenticated, remote attacker to cause high disk utilization, resulting in a denial of service (DoS) condition. The vulnerability occurs because a certain system log file does not have a maximum size restriction. Therefore, the file is allowed to consume the majority of available disk space on the appliance. An attacker could exploit this vulnerability by sending crafted remote connection requests to the appliance. Successful exploitation could allow the attacker to increase the size of a system log file so that it consumes most of the disk space. The lack of available disk space could lead to a DoS condition in which the application functions could operate abnormally, making the appliance unstable. This vulnerability affects the following Cisco Voice Operating System (VOS)-based products: Emergency Responder, Finesse, Hosted Collaboration Mediation Fulfillment, MediaSense, Prime License Manager, SocialMiner, Unified Communications Manager (UCM), Unified Communications Manager IM and Presence Service (IM&P - earlier releases were known as Cisco Unified Presence), Unified Communication Manager Session Management Edition (SME), Unified Contact Center Express (UCCx), Unified Intelligence Center (UIC), Unity Connection, Virtualized Voice Browser. This vulnerability also affects Prime Collaboration Assurance and Prime Collaboration Provisioning. Cisco Bug IDs: CSCvd10872, CSCvf64322, CSCvf64332, CSCvi29538, CSCvi29543, CSCvi29544, CSCvi29546, CSCvi29556, CSCvi29571, CSCvi31738, CSCvi31741, CSCvi31762, CSCvi31807, CSCvi31818, CSCvi31823.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ER
Emergency Responder · Cisco
10.5 before 10.5\(1a\); 11.0 before 11.5\(4\); 12.0 before 12.0su1; 11.0(1.10000.10) · source: NVD
FI
Finesse · Cisco
11.5 before 11.5\(3\); 9.5(1) · source: NVD
HC
Hosted Collaboration Mediation Fulfillment · Cisco
11.5 before 11.5\(3\); 9.5(1) · source: NVD
ME
Mediasense · Cisco
11.5 before 11.5su2; 9.5(1) · source: NVD
PC
Prime Collaboration Assurance · Cisco
11.6 before 11.6_es16; 12.1 before 12.1_es2 · source: NVD
PC
Prime Collaboration Provisioning · Cisco
12.5 · source: NVD
PL
Prime License Manager · Cisco
10.5 before 10.5.2; 11.0 before 11.5\(1\)su5 · source: NVD
SO
Socialminer · Cisco
11.6 before 11.6.1 · source: NVD
UC
Unified Communications Manager · Cisco
10.0 before 10.5\(2\)su5; 11.0 before 11.0\(1a\)su4; 11.5 before 11.5\(1\)su3; 10.5(2.10000.5); 11.0(1.10000.10); 11.5(1.10000.6); +1 more · source: NVD
UC
Unified Contact Center Express · Cisco
11.6 before 11.6\(1\); 9.0(2)su1.3 · source: NVD
UI
Unified Intelligence Center · Cisco
11.6 before 11.6\(1\); 9.5(1) · source: NVD
UC
Unity Connection · Cisco
10.5 before 10.5su5; 11.0 before 11.5.1su3; 9.5(0.9)tt0; 12.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-6779
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-6779
Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-diskdos
More from Emergency Responder
9.8
CVE-2023-20101
A vulnerability in Cisco Emergency Responder could allow an unauthenticated, remote attacker to log in to an affected device using the root account, which has default, static…
9.8
CVE-2017-12337
A vulnerability in the upgrade mechanism of Cisco collaboration products based on the Cisco Voice Operating System software platform could allow an unauthenticated, remote…
8.8
CVE-2024-20352
A vulnerability in Cisco Emergency Responder could allow an authenticated, remote attacker to conduct a directory traversal attack, which could allow the attacker to perform…
8.8
CVE-2016-6468
A vulnerability in the web-based management interface of Cisco Emergency Responder could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF)…
7.5
CVE-2023-20259
A vulnerability in an API endpoint of multiple Cisco Unified Communications Products could allow an unauthenticated, remote attacker to cause high CPU utilization, which could…
