Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

Sig Name: CUCM CTI DoS

I am seeing Sig ID: 6799 Subsig 0 a lot on our 4215.

Sig Name: CUCM CTI DoS
Sig ID: 6799
Severity: Medium
Risk Rating: 66
Sig Version: S448

I am looking for more information regarding this alert, is this flase positive?

1 REPLY
Cisco Employee

Re: Sig Name: CUCM CTI DoS

The best place to begin research on Cisco IPS signature issues is the Cisco IntelliShield site:

http://www.cisco.com/security

For this specific signature, the details are outlined here:

http://tools.cisco.com/security/center/viewIpsSignature.x?signatureId=6799&signatureSubId=0&softwareVersion=6.0&releaseVersion=S448

Details of the exploit detected are outlined here:

http://tools.cisco.com/security/center/viewAlert.x?alertId=16136

Without being able to see the traffic which triggered the signature it will not be possible to determine whether this is a false positivie or not.  Specific network conditions will assist more accurately determining the validity of the event.

Scott

1145
Views
0
Helpful
1
Replies