CVE-2013-1134

The Location Bandwidth Manager (LBM) Intracluster-communication feature in Cisco Unified Communications Manager (CUCM) 9.x before 9.1(1) does not require authentication from the remote LBM Hub node, which allows remote attackers to conduct cache-poisoning attacks against transaction records, and cause a denial of service (bandwidth-pool consumption and call outage), via unspecified vectors, aka Bug ID CSCub28920.

CVSS v2.0 7.1 HIGH

7.1^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:N/C:N/I:N/A:C

Exploitability : 8.6 / Impact : 6.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact COMPLETE

References

Link	Resource
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130227-cucm
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130227-cucm

Configurations

Configuration 1 (hide)

cpe:2.3:a:cisco:unified_communications_manager:9.0\(1\):*:*:*:*:*:*:*

History

No history.

Information

Published : 2013-02-27 21:55

Updated : 2025-04-11 00:51

NVD link : CVE-2013-1134

Mitre link : CVE-2013-1134

CVE.ORG link : CVE-2013-1134

JSON object : View

Products Affected

cisco

unified_communications_manager

CWE

CWE-287

Improper Authentication

{"id": "CVE-2013-1134", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.1, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:C", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 6.9, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2013-02-27T21:55:04.167", "references": [{"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130227-cucm", "source": "psirt@cisco.com"}, {"url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130227-cucm", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "The Location Bandwidth Manager (LBM) Intracluster-communication feature in Cisco Unified Communications Manager (CUCM) 9.x before 9.1(1) does not require authentication from the remote LBM Hub node, which allows remote attackers to conduct cache-poisoning attacks against transaction records, and cause a denial of service (bandwidth-pool consumption and call outage), via unspecified vectors, aka Bug ID CSCub28920."}, {"lang": "es", "value": "El Location Bandwidth Manager (LBM) entre clusters de comunicaci\u00f3n, caracter\u00edstica de Cisco Unified Communications Manager (CUCM) v9.x antes de v9.1 (1) no requiere la autenticaci\u00f3n del nodo concentrador remoto LBM, que permite a atacantes remotos realizar ataques de envenenamiento de cach\u00e9 en contra de transacci\u00f3n registros, y provocar una denegaci\u00f3n de servicio (consumo de ancho de banda y llamadas fuera de rango), a trav\u00e9s de vectores sin especificar, tambi\u00e9n conocido como Bug ID CSCub28920."}], "lastModified": "2025-04-11T00:51:21.963", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:unified_communications_manager:9.0\\(1\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B7285C0D-5337-49D0-A6EE-2385A7B4F510"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@cisco.com"}