CVE-2008-0027

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 57.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-01-17 · updated 2026-06-16
Weakness: CWE-119

Description

Heap-based buffer overflow in the Certificate Trust List (CTL) Provider service (CTLProvider.exe) in Cisco Unified Communications Manager (CUCM) 4.2 before 4.2(3)SR3 and 4.3 before 4.3(1)SR1, and CallManager 4.0 and 4.1 before 4.1(3)SR5c, allows remote attackers to cause a denial of service or execute arbitrary code via a long request.

Affected products

Cisco Unified Callmanager: 4.0, 4.1, 4.1(3)sr4, 4.1(3)sr5, 4.1(3)sr5b
Cisco Unified Communications Manager: 4.2, 4.2.3sr2, 4.2.3sr2b, 4.3

References

http://dvlabs.tippingpoint.com/advisory/TPTI-08-02
http://secunia.com/advisories/28530
http://securityreason.com/securityalert/3551
http://www.cisco.com/en/US/products/products_security_advisory09186a0080932c61.shtml
http://www.securityfocus.com/archive/1/486432/100/0/threaded
http://www.securityfocus.com/bid/27313
http://www.securitytracker.com/id?1019223
http://www.vupen.com/english/advisories/2008/0171
https://exchange.xforce.ibmcloud.com/vulnerabilities/39704
http://dvlabs.tippingpoint.com/advisory/TPTI-08-02
http://secunia.com/advisories/28530
http://securityreason.com/securityalert/3551

Get alerted when CVE-2008-0027 or the next vulnerability affects your stack