The OpenNET Project
 
Search (keywords):  SOFT ARTICLES TIPS & TRICKS SECURITY
LINKS NEWS MAN DOCUMENTATION


Cisco Unified IP Phone 7960G and 7940G (SIP) RTP Header Vulnerability


<< Previous INDEX Search src / Print Next >>
Date: Wed, 14 Jan 2009 13:29:32 +0100
From: Laurent Butti <laurent.butti@orange-ftgroup.com.>
To: [email protected]
Subject: Cisco Unified IP Phone 7960G and 7940G (SIP) RTP Header Vulnerability
X-Enigmail-Version: 0.95.7
Content-Type: text/plain; charset=ISO-8859-15
Content-Transfer-Encoding: 7bit
X-OriginalArrivalTime: 14 Jan 2009 12:29:21.0597 (UTC) FILETIME=[BA393ED0:01C97643]
X-Virus-Scanned: antivirus-gw at tyumen.ru

Title:
* Cisco Unified IP Phone 7960G and 7940G (SIP) RTP Header Vulnerability

Summary:
* The Cisco Unified IP Phone 7960G and 7940G (SIP) do not correctly
parse some malformed RTP headers leading to a deterministic denial of
service

Assigned CVE:
* CVE-2008-4444

Details:
* SIP protocol is used to set up calls between phones. Once the call is
established, the media content is carried by the RTP protocol. A remote
attacker could send a specially crafted RTP packet against a Cisco SIP
phone in such a way as to cause the phone to reboot.

Attack Impact:
* Denial-of-service (reboot or hang-up) and possibly remote arbitrary
code execution

Attack Vector:
* Have the possibility to setup a call to the targeted phone and carry
RTP frame to the vulnerable device
* Have access to the VoIP network while a call is established and inject
RTP frames

Timeline:
* 2008-06-13 - Vulnerability reported to Cisco
* 2008-06-16 - Full details sent to Cisco
* 2008-10-21 - Cisco released a patched firmware
* 2009-01-14 - Release of this security advisory

Affected Products:
* Cisco Unified IP Phone 7960G and 7940G (SIP) with P0S3-08-9-00
firmware. Cisco released a patched firmware on October 21, 2008 which is
described in the bug identifier CSCsu22285 (Cisco Unified IP Phone 7960G
and 7940G (SIP) Release Notes for Firmware Release 8.10).

Credits:
* This vulnerability was discovered by Gabriel Campana and Laurent Butti
from France Telecom / Orange


<< Previous INDEX Search src / Print Next >>



Партнёры:
PostgresPro
Inferno Solutions
Hosting by Hoster.ru
Хостинг:

Закладки на сайте
Проследить за страницей
Created 1996-2024 by Maxim Chirkov
Добавить, Поддержать, Вебмастеру