CVE-2021-1379

Description

Multiple vulnerabilities in the Cisco Discovery Protocol and Link Layer Discovery Protocol (LLDP) implementations for Cisco IP Phone Series 68xx/78xx/88xx could allow an unauthenticated, adjacent attacker to execute code remotely or cause a reload of an affected IP phone. These vulnerabilities are due to missing checks when the IP phone processes a Cisco Discovery Protocol or LLDP packet. An attacker could exploit these vulnerabilities by sending a malicious Cisco Discovery Protocol or LLDP packet to the targeted IP phone. A successful exploit could allow the attacker to execute code on the affected IP phone or cause it to reload unexpectedly, resulting in a denial of service (DoS) condition.Note: Cisco Discovery Protocol is a Layer 2 protocol. To exploit these vulnerabilities, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent).Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.

Gravité et risque d'exploitation

CVE-2021-1379 obtient un score CVSS de 6.5/10, soit une gravité moyenne. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 0.33 %, ce qui la place devant 24.5 % des CVE référencées.

Que faire ?

• Vérifiez si Cisco IP Phones with Multiplatform Firmware (versions 11.0.2, 11.7(1), 9.3(1), 11.1.1 MSR1-1, 7.5.6a, 12.8(1), 9.4(2)SR1, 11.0(5)SR3, 10.3(1.9) 3rd Party, 11.1.2 MSR1-1, 11.3.1 MSR3-3, 11.0(3)SR6, 7.6.2SR5, 11.3.1 MSR1-3, 9.3(1)SR2, 11.2.1, 11.0(2)SR2, 11.0.1, 12.7(1), 12.6(1), 7.6.2SR1, 9.3(4) 3rd Party, 11.0(3)SR2, 10.3(1)SR3, 7.3.7, 11.0(4)SR3, 7.4.7, 11.0(3)SR5, 11.0(2)SR1, 7.5.1, 9.0(3), 9.4(2)SR2, 12.7(1)SR1, 11.1.1 MSR2-1, 7.6.2SR6, 11.0(5)SR1, 9.1(1)SR1, 10.3(1)SR4, 11.0(0.7) MPP, 10.3(1)SR5, 7.5.2b, 9.2(1), 7.6.0, 11.0(4)SR1, 9.3(4)SR2 3rd Party, 7.6.2SR7, 10.2(2), 9.2(1)SR2, 7.5.7, 10.3(1)SR1, 7.5.7s, 7.5.2, 7.4.3, 11.5(1)SR1, 10.3(1)SR6, 11.0.0, 11.0(2), 7.6.2, 11.1.1, 11.3.2, 10.4(1) 3rd Party, 9.3(4)SR3 3rd Party, 7.4.6, 11.0(3)SR4, 9.0(2)SR1, 10.3(2), 7.4.9, 10.3(1), 11.0(3)SR3, 11.2.3 MSR1-1, 10.4(1)SR2 3rd Party, 10.2(1)SR1, 11.1.2 MSR3-1, 12.6(1)SR1, 12.0(1)SR3, 12.5(1), 12.5(1)SR2, 7.5.5, 11.0(5)SR2, 7.5.5a, 7.4.8, 7.4.4, 9.3(1)SR1, 10.1(1.9), 7.5.6(XU), 7.5.3, 11.0(4), 7.5.4, 12.0(1)SR1, 11-0-1MSR1-1, 10.3(1)SR4b, 11.0(4)SR2, 7.5.2a, 9.2(3), 10.2(1), 12.0(1), 11.2.2, 11.0(3)SR1, 7.5.5b, 7.5.6c, 11.0(5), 9.3(1)SR3, 7.6.1, 12.1(1)SR1, 10.1(1)SR2, 7.6.2SR4, 10.3(1.11) 3rd Party, 9.3(4)SR1 3rd Party, 12.1(1), 10.3(1)SR2, 7.5.6, 11.5(1), 9.4(2)SR3, 9.3(3), 9.3(1)SR4, 7.6.2SR3, 11.3.1, 10.1(1)SR1, 11.1.2, 11.2.4, 12.5(1)SR1, 12.0(1)SR2, 12.5(1)SR3, 7.6.2SR2, 11.2.3, 11.0(1), 9.4(2)SR4, 9.0(2)SR2, 11.3.1 MSR2-6, 11.0(3), 11.0.1 MSR1-1, 9.4(2)) est présent sur votre parc.
• Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
• À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
• Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.

Références

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ipphone-rce-dos-U2PsSkz3
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-distupd-N87eB6Z3