Cisco Unified Communications Manager IM&P Service, Cisco TelePresence VCS, and Cisco Expressway Series Denial of Service Vulnerability

[Ciscollab_Amit]

Hello guys,

There was recently a CSA published about a vulnerability in the authentication service of the Cisco Unified Communications Manager IM and Presence (Unified CM IM&P) Service, Cisco TelePresence Video Communication Server (VCS), and Cisco Expressway Series. This could allow an unauthenticated, remote attacker to cause a service outage for users attempting to authenticate, resulting in a denial of service (DoS) condition.

Advisory ID:

cisco-sa-20190605-cucm-imp-dos

They do mention the fixed software releases as well.

Cisco Unified CM IM&P Service Major Release First Fixed Release

10.5(2)	11.5(1) SU6 or 12.5(1)
11.5(1)	11.5(1) SU6
12.0(1)	12.5(1)
12.5(1)	Not vulnerable

However it is a bit confusing to understand if this also affects other CUCM versions? One of my Customer has CUCM  IMP 11.0.1.23900-5. Can anyone suggest if this specific version is also affected?

Thanks,

Amit

[Mike_Brezicky]

I believe this is for CVE-2019-1845. If the release is not mentioned in the affected releases, chances are it is safe, however I would always be pessimistic in security and feel if they did not listed, its just not confirmed YET. As the customer is already on 11.x, 11.5(1) SU6 is a simple and safe upgrade if they choose to do so. I would recommended upgrading anyway to get off a X.0 release.