Time to SIP from Cisco's patch pool, to fix a memory leak
IOS, IOS XE and Unified Communications Manager all vulnerable
Cisco's urging SIP users to patch their software, after discovering a remotely-exploitable denial-of-service vector in a memory leak.
The issue was discovered while resolving a customer support issue, the company says.
Since the same code is used across multiple systems, sysadmins need to check their vulnerability if they're using IOS, IOS XE, or Unified Communications Manager 8.x and later, and can be triggered by SIP traffic on IPv4 or IPv6.
The command show memory debug leaks summary will return CCSIP_UDP_SOCKET in the leak list if a system is vulnerable. Cisco notes that the command should be “used with caution” because it hammers the CPU.
Cisco's advisory says the vulnerability is triggered by malformed SIP messages directed to the device, adding that “transit SIP traffic is not an exploit vector.”
Patches have been issued for all systems except Unified Communications Manager 8.x, which is past its use-by date; those users will have to upgrade to a later version.
The only alternative to patching is to disable SIP on the affected device, which El Reg reckons probably won't be practical advice.
Other security fixes just issued by Cisco cover various DoS vulnerabilities in Catalyst and Nexus switches; IOS WAN application services; IOS and IOS XE's Smart Install client; and IOS / IOS XE Internet Key Exchange version 2. ®