CVE:CVE-2008-0027
CNNVD:CNNVD-200801-260
Cisco Unified Communications Manager(CUCM，之前被称为CallManager)是Cisco IP电话解决方案中的呼叫处理组件。
CUCM中默认绑定在TCP/2444端口上的CTL Provider服务(CTLProvider.exe)存在堆溢出漏洞，远程攻击者可能利用此漏洞控制服务器。
该漏洞存在于接收套接字数据期间所使用的循环中的逻辑错误。代码分配了0x19000字节长的初始缓冲区：
.text:00406077 191A8 68+      push    19000h
; size_t
.text:0040607C 191AC FF+      call    ds:__imp_malloc
.text:00406082 191AC 83+      add     esp, 10h
.text:00406085 1919C 89+      mov     [edi+14h], eax
.text:00406088 1919C 85+      test    eax, eax
.text:0040608A 1919C 0F+      jz      loc_406238
分配完成后在缓冲区写入数据。如果套接字中剩余的数据多于0x4000字节的话，就会再次陷入循环：
.text:004060A5 191AC FF+      push    dword ptr [ebp-14h]
; size_t
.text:004060A8 191B0 8D+      lea     eax, [ebp-1919Ch]
.text:004060AE 191B0 50       push    eax
; void *
.text:004060AF 191B4 8B+      mov     eax, [edi+14h]
.text:004060B2 191B4 03+      add     eax, [ebp-1Ch]
.text:004060B5 191B4 50       push    eax
; void *
.text:004060B6 191B8 E8+      call    memcpy
.text:004060B6 191B8 2F+
.text:004060BB 191B8 B8+      mov     eax, 16384
.text:004060C0 191B8 83+      add     esp, 1Ch
.text:004060C3 1919C 39+      cmp     [ebp-14h], eax
.text:004060C6 1919C 75+      jnz     short loc_4060F8
.text:004060C8 1919C 50       push    eax
; int
.text:004060C9 191A0 68+      push    offset str__ErrDExceeds16k
; 'err %d exceeds 16K'
.text:004060CE 191A4 8D+      lea     eax, [ebp-88h]
.text:004060D4 191A4 68+      push    80000h
; int
.text:004060D9 191A8 50       push    eax
; int
.text:004060DA 191AC E8+      call    log_message
.text:004060DA 191AC B7+
.text:004060DF 191AC 83+      add     esp, 10h
.text:004060E2 1919C 81+      add     dword ptr [ebp-1Ch], 4000h
.text:004060E9 1919C 68+      push    offset
str__MaybeThereIsMoreData__readAgain ; "Maybe there is more data..Read
again"
.text:004060EE 191A0 68+      push    10000h
.text:004060F3 191A4 E9+      jmp     loc_405FFF
这个过程会一直继续，直到覆盖了堆块，导致执行任意指令。
solution:Upgrade cisco unified_callmanager to a higher version than 4.0,4.1,4.1(3sr4,4.1(3sr5,4.1(3sr5b,and avoid the version 4.0,4.1,4.1(3)sr4,4.1(3)sr5,4.1(3)sr5b; Upgrade cisco unified_communications_manager to a higher version than 4.2,4.2.3sr2,4.2.3sr2b,4.3,and avoid the version 4.2,4.2.3sr2,4.2.3sr2b,4.3