CVE-2017-3790 : What You Need to Know

A security flaw in Cisco Expressway Series and Cisco TelePresence VCS Software versions prior to X8.8.2 could lead to a denial of service (DoS) attack by a remote unauthenticated attacker.

Understanding CVE-2017-3790

A vulnerability in the packet parser of Cisco Expressway Series and Cisco TelePresence VCS Software could allow an attacker to cause a system reload, resulting in a DoS condition.

What is CVE-2017-3790?

The vulnerability arises from inadequate validation of user-supplied data size in the packet parser.
Attackers can exploit this by sending manipulated H.224 data in RTP packets during an H.323 call, causing a buffer overflow and application crash.

The Impact of CVE-2017-3790

Allows remote unauthenticated attackers to reload affected systems, leading to a DoS situation.
No workarounds are available, but Cisco has released software updates to address the issue.

Technical Details of CVE-2017-3790

A detailed look at the technical aspects of the vulnerability.

Vulnerability Description

Insufficient size validation of user-supplied data in the packet parser.
Exploitation through crafted H.224 data in RTP packets during H.323 calls.
Buffer overflow in the cache associated with the packet parser leading to application crash.

Affected Systems and Versions

Cisco Expressway Series Software and Cisco TelePresence VCS Software versions before X8.8.2.

Exploitation Mechanism

Attackers send manipulated H.224 data in RTP packets during H.323 calls.
Buffer overflow in the cache associated with the packet parser causes application crash.

Mitigation and Prevention

Steps to mitigate and prevent exploitation of CVE-2017-3790.

Immediate Steps to Take

Apply the software updates released by Cisco to address the vulnerability.

Long-Term Security Practices

Regularly update software to the latest versions to patch known vulnerabilities.
Implement network segmentation and access controls to limit exposure to potential attacks.

Patching and Updates

Cisco has released software updates to fix the vulnerability.