CVE-2011-3288 | Cisco Unified Presence - XML Parser Operational Intel

Executive Risk Summary

"The Cisco Unified Presence server is vulnerable to a denial-of-service attack due to a bug in the XML parser, which can cause memory and CPU consumption, and process crash. This can be exploited by sending a crafted XML document containing a large number of nested entity references."

Anticipated Attack Path

1. Attacker sends a crafted XML document to the Cisco Unified Presence server
2. The XML parser fails to properly detect recursion during entity expansion
3. The server crashes due to memory and CPU consumption

Am I Vulnerable?

Verify the Cisco Unified Presence server version is before 8.5(4)
Check for signs of denial-of-service attacks, such as high CPU and memory usage
Monitor system logs for errors related to XML parsing

Operational Audit Arsenal

Target Type Process

Target Asset cupsservice.exe

Standard Path C:\Program Files\Cisco\Unified Presence\

Manual Verification Required

This is a non-Windows asset (Cisco). Use the target asset details and official path provided above to verify your current version against the official vendor advisories listed below.