Cisco IOS fails to properly handle Session Initiated Protocol packets

ID VU:438176
Type cert
Reporter CERT
Modified 2007-02-08T00:00:00



Cisco devices that run IOS and support voice traffic fail to properly handle Session Initiated Protocol packets. Exploitation of this vulnerability may result in a denial-of-service condition.


Cisco IOS is an operating system that is used on Cisco network devices. According to Cisco, "Session Initiation Protocol (SIP) is the Internet Engineering Task Force's (IETF's) standard for multimedia conferencing over IP. SIP is an ASCII-based, application-layer control protocol (defined in RFC 2543) that can be used to establish, maintain, and terminate calls between two or more end points." SIP typically operates on ports 5060/udp and 5060/tcp.

Cisco devices that run IOS and support voice traffic may have SIP enabled by default but not properly configured. Cisco devices with this configuration contain an unspecified vulnerability that may cause the device to reboot when a SIP packet is processed.

For more information, including a list of affected products and versions of IOS refer to Cisco Security Advisory: cisco-sa-20070131-sip.


A remote, unauthenticated attacker with the ability to send a specially crafted packet to an affected Cisco device may be able to cause that device to reboot. Sustained exploitation of this vulnerability may result in a denial-of-service. Because devices running IOS may transit traffic for a number of other networks, the secondary impacts of a denial of service may be severe.


Upgrade to an unaffected version of IOS
See the Software Version and Fixes section of Cisco Security Advisory: cisco-sa-20070131-sip for information on available upgrades.

Turn off SIP processing

Disabling SIP if it is not needed will prevent this vulnerability from being exploited. For instructions on how to turn off SIP processing, refer to the Workarounds section of Cisco Security Advisory cisco-sa-20070131-sip.

Restrict Access

Cisco does not have any examples of a properly configured SIP router being affected by this vulnerability. If you do not need SIP processed on your router, you can also restrict public access to SIP (udp 5060 and TCP 5060) on your router from the edge of your network.

Other workarounds and mitigation strategies can be found in the Cisco Applied Intelligence Response: Identifying and Mitigating Exploitation of the SIP Packet Reloads IOS Devices Not Configured for SIP Vulnerability document.

Systems Affected

Vendor| Status| Date Notified| Date Updated
Cisco Systems, Inc.| | -| 31 Jan 2007
If you are a vendor and your product is affected, let us know.

CVSS Metrics

Group | Score | Vector
Base | N/A | N/A
Temporal | N/A | N/A
Environmental | N/A | N/A


  • <>
  • <>
  • <>
  • <>
  • <>
  • <>
  • <>


This vulnerability was reported in Cisco Security Advisory: cisco-sa-20070131-sip .

This document was written by Jeff Gennari based on information from Cisco.

Other Information

  • CVE IDs: CVE-2007-0648
  • Date Public: 31 Jan 2007
  • Date First Published: 31 Jan 2007
  • Date Last Updated: 08 Feb 2007
  • Severity Metric: 33.08
  • Document Revision: 18