Cisco Unified Communications Manager Multiple Vulnerabilities

Multiple vulnerabilities were identified in Cisco Unified Communications Manager. A remote authenticated user can cause denial of service conditions and execute arbitrary commands on the target system.

1. A remote authenticated user on a registered endpoint can send specially crafted XML data via SIP to cause the target process to crash.
2. A remote authenticated user can send specially crafted Kerberos single sign-on (SSO) token data to exploit a flaw in the CTIManager module and execute arbitrary commands with elevated privileges.
   Systems with the Cisco CTIManager enabled and configured for single sign-on are affected.