CVE Feed

    Dashboard / CVE / CVE-2008-0027

    CVE-2008-0027

    Heap-based buffer overflow in the Certificate Trust List (CTL) Provider service (CTLProvider.exe) in Cisco Unified Communications Manager (CUCM) 4.2 before 4.2(3)SR3 and 4.3 before 4.3(1)SR1, and CallManager 4.0 and 4.1 before 4.1(3)SR5c, allows remote attackers to cause a denial of service or execute arbitrary code via a long request.

    Published:Jan 17, 2008
    Last Modified:Apr 23, 2026
    EPS:Jan 17, 2008
    EPSS Score:0.35513
    CVSS Score:10

    Affected Products

    Vendor
    Cisco
    Product
    Unified Callmanager
    Vendor
    Cisco
    Product
    Unified Communications Manager

    Exploits

    No exploit reference

    Related CVEs

    CVE-2015-0680 (CVSS 4) — Cisco Unified Call Manager (CM) 9.1(2.1000.28) does not properly restrict resource requests, which allows remo…
    CVE-2009-2864 (CVSS 7.8) — Cisco Unified Communications Manager (aka CUCM, formerly CallManager) 5.x before 5.1(3g), 6.x before 6.1(4), 7…
    CVE-2008-3801 (CVSS 7.1) — Unspecified vulnerability in the Session Initiation Protocol (SIP) implementation in Cisco IOS 12.2 through 12…
    CVE-2008-3800 (CVSS 7.1) — Unspecified vulnerability in the Session Initiation Protocol (SIP) implementation in Cisco IOS 12.2 through 12…
    CVE-2008-1744 (CVSS 7.8) — The Certificate Authority Proxy Function (CAPF) service in Cisco Unified Communications Manager (CUCM) 4.1 bef…
    CVE-2008-0026 (CVSS 6.5) — SQL injection vulnerability in Cisco Unified CallManager/Communications Manager (CUCM) 5.0/5.1 before 5.1(3a) …
    CVE-2007-5537 (CVSS 7.8) — Cisco Unified Communications Manager (CUCM, formerly CallManager) 5.1 before 5.1(2), and Unified CallManager 5…
    CVE-2007-5538 (CVSS 10) — Buffer overflow in the Centralized TFTP File Locator Service in Cisco Unified Communications Manager (CUCM, fo…
    CVE-2006-5278 (CVSS 10) — Integer overflow in the Real-Time Information Server (RIS) Data Collector service (RisDC.exe) in Cisco Unified…
    CVE-2006-5277 (CVSS 9.3) — Off-by-one error in the Certificate Trust List (CTL) Provider service (CTLProvider.exe) in Cisco Unified Commu…

    References

    http://dvlabs.tippingpoint.com/advisory/TPTI-08-02
    http://secunia.com/advisories/28530
    http://securityreason.com/securityalert/3551
    http://www.cisco.com/en/US/products/products_security_advisory09186a0080932c61.shtml
    http://www.securityfocus.com/archive/1/486432/100/0/threaded
    http://www.securityfocus.com/bid/27313
    http://www.securitytracker.com/id?1019223
    http://www.vupen.com/english/advisories/2008/0171
    https://exchange.xforce.ibmcloud.com/vulnerabilities/39704
    http://dvlabs.tippingpoint.com/advisory/TPTI-08-02
    http://secunia.com/advisories/28530
    http://securityreason.com/securityalert/3551
    http://www.cisco.com/en/US/products/products_security_advisory09186a0080932c61.shtml
    http://www.securityfocus.com/archive/1/486432/100/0/threaded
    http://www.securityfocus.com/bid/27313
    http://www.securitytracker.com/id?1019223
    http://www.vupen.com/english/advisories/2008/0171
    https://exchange.xforce.ibmcloud.com/vulnerabilities/39704

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High