Vulnerabilities > CVE-2006-5277 - Heap Buffer Overflow vulnerability in Cisco products

CVSS 9.3 - CRITICAL

Attack vector

NETWORK

Attack complexity

MEDIUM

Privileges required

NONE

Confidentiality impact

COMPLETE

Integrity impact

COMPLETE

Availability impact

COMPLETE

network

cisco

critical

NVD

Published: 2007-07-15

Updated: 2018-10-17

Summary

Off-by-one error in the Certificate Trust List (CTL) Provider service (CTLProvider.exe) in Cisco Unified Communications Manager (CUCM, formerly CallManager) before 20070711 allow remote attackers to execute arbitrary code via a crafted packet that triggers a heap-based buffer overflow.

Vulnerable Configurations

Part	Description	Count
Application	Cisco Cisco Unified Callmanager 3.3 Cisco Unified Callmanager 3.3\(2\) Cisco Unified Callmanager 3.3\(2\)Spb Cisco Unified Callmanager 3.3\(2\)Spc Cisco Unified Callmanager 3.3\(3\) Cisco Unified Callmanager 3.3\(3\)Sr1 Cisco Unified Callmanager 3.3\(3\)Sr4 Cisco Unified Callmanager 3.3\(4\) Cisco Unified Callmanager 3.3\(4\)Sr1A Cisco Unified Callmanager 3.3\(5\) Cisco Unified Callmanager 3.3\(5\)Sr1 Cisco Unified Callmanager 3.3\(5\)Sr1A Cisco Unified Callmanager 3.3\(5\)Sr2 Cisco Unified Callmanager 4.1 Cisco Unified Callmanager 4.1\(2\) Cisco Unified Callmanager 4.1\(3\) Cisco Unified Callmanager 4.1\(3\)Sr1 Cisco Unified Callmanager 4.1\(3\)Sr2 Cisco Unified Callmanager 4.1\(3\)Sr3 Cisco Unified Callmanager 4.1\(3\)Sr4 Cisco Unified Callmanager 4.2 Cisco Unified Callmanager 4.2\(3\)Sr1 Cisco Unified Callmanager 5.0 Cisco Unified Communications Manager 4.3 Cisco Unified Communications Manager 4.3\(1\) Cisco Unified Communications Manager 5.1 Cisco Unified Communications Manager 5.1\(1\)	27

Summary

Vulnerable Configurations

References