Details of VAR-201708-1352

ID

VAR-201708-1352

CVE

CVE-2017-6763

TITLE

Cisco Meeting Server Input validation vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2017-006842

DESCRIPTION

A vulnerability in the implementation of the H.264 protocol in Cisco Meeting Server (CMS) 2.1.4 could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected system. The vulnerability exists because the affected application does not properly validate Fragmentation Unit (FU-A) protocol packets. An attacker could exploit this vulnerability by sending a crafted H.264 FU-A packet through the affected application. A successful exploit could allow the attacker to cause a DoS condition on the affected system due to an unexpected restart of the CMS media process on the system. Although the CMS platform continues to operate and only the single, affected CMS media process is restarted, a brief interruption of media traffic for certain users could occur. Cisco Bug IDs: CSCve10131. Cisco Meeting Server (CMS) Contains an input validation vulnerability. Vendors have confirmed this vulnerability Bug ID CSCve10131 It is released as.Service operation interruption (DoS) There is a possibility of being put into a state

Trust: 1.98

sources: NVD: CVE-2017-6763 // JVNDB: JVNDB-2017-006842 // BID: 100111 // VULHUB: VHN-114966

AFFECTED PRODUCTS

vendor:

cisco

model:

meeting server

scope:

version:

2.1.4

Trust: 2.7

sources: BID: 100111 // JVNDB: JVNDB-2017-006842 // CNNVD: CNNVD-201708-134 // NVD: CVE-2017-6763

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-6763
value:	HIGH
Trust: 1.0
NVD:	CVE-2017-6763
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201708-134
value:	HIGH
Trust: 0.6
VULHUB:	VHN-114966
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2017-6763
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-114966
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2017-6763
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.0
Trust: 1.8

sources: VULHUB: VHN-114966 // JVNDB: JVNDB-2017-006842 // CNNVD: CNNVD-201708-134 // NVD: CVE-2017-6763

PROBLEMTYPE DATA

problemtype:

CWE-20

Trust: 1.9

sources: VULHUB: VHN-114966 // JVNDB: JVNDB-2017-006842 // NVD: CVE-2017-6763

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201708-134

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-201708-134

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-006842

PATCH

title:	CSCve10131 - Cisco Meeting Server H.264 Protocol Denial of Service Vulnerability	url:	https://quickview.cloudapps.cisco.com/quickview/bug/CSCve10131	Trust: 0.8
title:	cisco-sa-20170802-ms	url:	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170802-ms	Trust: 0.8
title:	Cisco Meeting Server Security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=72376	Trust: 0.6

sources: JVNDB: JVNDB-2017-006842 // CNNVD: CNNVD-201708-134

EXTERNAL IDS

db:	NVD	id:	CVE-2017-6763	Trust: 2.8
db:	BID	id:	100111	Trust: 2.0
db:	SECTRACK	id:	1039058	Trust: 1.7
db:	JVNDB	id:	JVNDB-2017-006842	Trust: 0.8
db:	CNNVD	id:	CNNVD-201708-134	Trust: 0.7
db:	VULHUB	id:	VHN-114966	Trust: 0.1

sources: VULHUB: VHN-114966 // BID: 100111 // JVNDB: JVNDB-2017-006842 // CNNVD: CNNVD-201708-134 // NVD: CVE-2017-6763

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20170802-ms	Trust: 2.0
url:	http://www.securityfocus.com/bid/100111	Trust: 1.7
url:	https://quickview.cloudapps.cisco.com/quickview/bug/cscve10131	Trust: 1.7
url:	http://www.securitytracker.com/id/1039058	Trust: 1.7
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-6763	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2017-6763	Trust: 0.8
url:	http://www.cisco.com/	Trust: 0.3

sources: VULHUB: VHN-114966 // BID: 100111 // JVNDB: JVNDB-2017-006842 // CNNVD: CNNVD-201708-134 // NVD: CVE-2017-6763

CREDITS

Cisco

Trust: 0.9

sources: BID: 100111 // CNNVD: CNNVD-201708-134

SOURCES

db:	VULHUB	id:	VHN-114966
db:	BID	id:	100111
db:	JVNDB	id:	JVNDB-2017-006842
db:	CNNVD	id:	CNNVD-201708-134
db:	NVD	id:	CVE-2017-6763

LAST UPDATE DATE

2025-04-20T23:30:53.525000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-114966	date:	2019-10-09T00:00:00
db:	BID	id:	100111	date:	2017-08-02T00:00:00
db:	JVNDB	id:	JVNDB-2017-006842	date:	2017-09-05T00:00:00
db:	CNNVD	id:	CNNVD-201708-134	date:	2019-10-17T00:00:00
db:	NVD	id:	CVE-2017-6763	date:	2025-04-20T01:37:25.860

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-114966	date:	2017-08-07T00:00:00
db:	BID	id:	100111	date:	2017-08-02T00:00:00
db:	JVNDB	id:	JVNDB-2017-006842	date:	2017-09-05T00:00:00
db:	CNNVD	id:	CNNVD-201708-134	date:	2017-08-04T00:00:00
db:	NVD	id:	CVE-2017-6763	date:	2017-08-07T06:29:00.637