CVE-2006-5277 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Cisco Unified Callmanager

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer4 documents4 sources
Severity
9.3CRITICALNVD
EPSS
5.7%
top 9.60%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Unified CallmanagerCisco Unified Communications Manager
Timeline
PublishedJul 15
Latest updateMay 1

Description

Off-by-one error in the Certificate Trust List (CTL) Provider service (CTLProvider.exe) in Cisco Unified Communications Manager (CUCM, formerly CallManager) before 20070711 allow remote attackers to execute arbitrary code via a crafted packet that triggers a heap-based buffer overflow.

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages2 packages

▶NVDcisco/unified_callmanager3.3 — 3.3\(5\)sr2+3
▶NVDcisco/unified_communications_manager4.3 — 4.3\(1\)+1

🔴Vulnerability Details

2
GHSA
GHSA-cj86-xvvm-mh59: Off-by-one error in the Certificate Trust List (CTL) Provider service (CTLProvider↗2022-05-01
▶
CVEList
CVE-2006-5277: Off-by-one error in the Certificate Trust List (CTL) Provider service (CTLProvider↗2007-07-15
▶

📋Vendor Advisories

1
Cisco
Cisco Unified Communications Manager Overflow Vulnerabilities↗2007-07-11
▶
CVE-2006-5277 — Cisco Unified Callmanager vulnerability | cvebase