CVE-2007-0859

The Find feature in Palm OS Treo smart phones operates despite the system password lock, which allows attackers with physical access to obtain sensitive information memory contents by doing 1 text searches or 2 paste operations after pressing certain keyboard shortcut keys...

ProCheckUp Security Advisory 2006.14

PR06-14: IP Phones based on Centrality Communications/Aredfox PA168 chipset weak session management vulnerability This advisory has been published following consultation with UK NISCC http://www.niscc.gov.uk/ Date Found: 3rd November 2006 Date Public: 22nd January 2007 Vulnerable: Phones confirme...

CVE-2007-0528

The CVE-2007-0528 entry describes an unauthenticated admin web console on Centrality Communications (aka Aredfox) PA168 chipset devices, firmware 1.54 and earlier. The HTTP interface does not require passwords or auth tokens, allowing remote attackers to connect to existing superuser sessions and...

PA168 Chipset IP Phones Weak Session Management Exploit

No description provided by source. !/bin/bash PR06-14: IP Phones based on Centrality Communications/Aredfox PA168 chipset weak session management vulnerability Author: Adrian Pastor adrian.pastor-AT-procheckup.com from ProCheckUp This advisory has been published following consultation with UK NIS...

Bluetooth DoS by obex push

Hello, during a course project studying security and privacy related to Bluetooth, we discovered a simple but effective DoS attack using OBEX push. Using ussp-push 1, it is possible to send out files very quickly. By continuously trying to push a ?le, the target is ?ooded with prompts whether to...

Multiple mobile phones bluetooth DoS

Flood with ussp-push messages causes user interface blocking by multiple download prompt messages...

Multiple IP Phones unauthorized access

After administrative login it's possible to access administration interface from any IP without password validation...

Vote! Pro 4.0 - Multiple PHP Code Execution Vulnerabilities

Vote! Pro 4.0 - Multiple PHP Code Execution Vulnerabilities source: https://www.securityfocus.com/bid/22191/info Multiple VoIP phones using the Aredfox PA168 Chipset are prone to a session-hijacking vulnerability due to a design error. An attacker can exploit this issue to gain administrative...

Opera 9.10 - '.jpg' Image DHT Marker Heap Corruption

Opera JPEG processing - Heap corruption vulnerabilities ======================================================= Date..: 8th September 2006 31th October 2006 update 3rd November 2006 update 5th January 2007 public release http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=457...

Debian DSA-1229-1 : asterisk - integer overflow

Adam Boileau discovered an integer overflow in the Skinny channel driver in Asterisk, an Open Source Private Branch Exchange or telephone system, as used by Cisco SCCP phones, which allows remote attackers to execute arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

DSA-1229-1 asterisk

Bulletin has no description...

DEBIAN-CVE-2006-5444

Integer overflow in the getinput function in the Skinny channel driver chanskinny.c in Asterisk 1.0.x before 1.0.12 and 1.2.x before 1.2.13, as used by Cisco SCCP phones, allows remote attackers to execute arbitrary code via a certain dlen value that passes a signed integer comparison and leads t...

CVE-2006-5444

Integer overflow in the getinput function in the Skinny channel driver chanskinny.c in Asterisk 1.0.x before 1.0.12 and 1.2.x before 1.2.13, as used by Cisco SCCP phones, allows remote attackers to execute arbitrary code via a certain dlen value that passes a signed integer comparison and leads t...

CVE-2006-5444

Integer overflow in the getinput function in the Skinny channel driver chanskinny.c in Asterisk 1.0.x before 1.0.12 and 1.2.x before 1.2.13, as used by Cisco SCCP phones, allows remote attackers to execute arbitrary code via a certain dlen value that passes a signed integer comparison and leads t...

CVE-2006-5444

CVE-2006-5444 involves an integer overflow in Asterisk’s Skinny channel driver (chan_skinny.c). Affected are Asterisk 1.0.x before 1.0.12 and 1.2.x before 1.2.13, used by Cisco SCCP phones. An attacker can trigger a heap-based buffer overflow via a crafted dlen value, potentially leading to remot...

CVE-2006-5444

Integer overflow in the getinput function in the Skinny channel driver chanskinny.c in Asterisk 1.0.x before 1.0.12 and 1.2.x before 1.2.13, as used by Cisco SCCP phones, allows remote attackers to execute arbitrary code via a certain dlen value that passes a signed integer comparison and leads t...

CVE-2006-5444

Integer overflow in the getinput function in the Skinny channel driver chanskinny.c in Asterisk 1.0.x before 1.0.12 and 1.2.x before 1.2.13, as used by Cisco SCCP phones, allows remote attackers to execute arbitrary code via a certain dlen value that passes a signed integer comparison and leads t...

Skinny Server Detection

The remote server is an H.323 proxy that understands the Skinny protocol, also known as SCCP, for 'Skinny Client Control Protocol'. Skinny is Cisco's proprietary lightweight terminal control protocol used by some VoIP phones to communicate with Cisco CallManager or Asterisk PBX systems. C Tenable...

Security-Assessment.com Advisory: Asterisk remote heap overflow

======================================================================== = Asterisk - chanskinny Remote Unauthenticated Heap Overflow = = Vendor Website: = http://www.asterisk.org = = Affected Version: = All 1.2-branch releases prior to and including 1.2.12.1 = All 1.0-branch releases prior to an...

asterisk -- remote heap overwrite vulnerability

Adam Boileau of Security-Assessment.com reports: The Asterisk Skinny channel driver for Cisco SCCP phones chanskinny.so incorrectly validates a length value in the packet header. An integer wrap-around leads to heap overwrite, and arbitrary remote code execution as root...