CVE-2018-0280: cisco meeting_server Improper Input Validation

Vulnerability summary

CVE-2018-0280 is a high (CVSS 7.5) Improper Input Validation vulnerability in cisco meeting_server. EPSS estimates a 3.27% chance of exploitation in the next 30 days, higher than 88.2% of scored vulnerabilities.

Timeline

1. 17-05-2018
   PublishedVulnerability first disclosed.
2. 29-11-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in the Real-Time Transport Protocol (RTP) bitstream processing of the Cisco Meeting Server could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to insufficient input validation of incoming RTP bitstreams. An attacker could exploit this vulnerability by sending a crafted RTP bitstream to an affected Cisco Meeting Server. A successful exploit could allow the attacker to deny audio and video services by causing media process crashes resulting in a DoS condition on the affected product. This vulnerability affects Cisco Meeting Server deployments that are running Cisco Meeting Server Software Releases 2.0, 2.1, 2.2, and 2.3. Cisco Bug IDs: CSCve79693, CSCvf91393, CSCvg64656, CSCvh30725, CSCvi86363.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.