AST-2014-015: Remote Crash Vulnerability in PJSIP channel driver

Asterisk Project Security Advisory - AST-2014-015 Product Asterisk Summary Remote Crash Vulnerability in PJSIP channel driver Nature of Advisory Denial of Service Susceptibility Remote Unauthenticated Sessions Severity Moderate Exploits Known No Reported On 30 October 2014 Reported By Yaron Nahum...

SIP Script Remote Command Execution via Shellshock

The remote host appears to be running SIP. SIP itself is not vulnerable to Shellshock; however, any Bash script that SIP runs for filtering or other routing tasks could potentially be affected if the script exports an environmental variable from the content or headers of a SIP message. A negative...

VoIP Penetration Testing Kit: Viproy

Viproy Voip Pen-Test Kit provides penetration testing modules for VoIP networks. It supports signalling analysis for SIP and Skinny protocols, IP phone services and network infrastructure. Viproy 2.0 is released at Blackhat Arsenal USA 2014 with TCP/TLS support for SIP, vendor extentions support,...

Cisco TelePresence VCS / Expressway Series < 8.2 Multiple DoS Vulnerabilities

According to the self-reported version, returned by a standard SNMP request, the version of the Cisco TelePresence VCS or Expressway Series device prior to 8.2. It is, therefore, potentially affected by multiple denial of service vulnerabilities : - A flaw exists in packet processing when...

CVE-2014-3370

Cisco TelePresence Video Communication Server VCS and Expressway Software before X8.1.1 allow remote attackers to cause a denial of service device reload via crafted SIP packets, aka Bug IDs CSCum60442 and CSCum60447...

CVE-2014-3369

The SIP IX implementation in Cisco TelePresence Video Communication Server VCS and Expressway Software before X8.1.1 allows remote attackers to cause a denial of service device reload via crafted SDP packets, aka Bug ID CSCuo42252...

Code injection

Cisco TelePresence Video Communication Server VCS and Expressway Software before X8.1.1 allow remote attackers to cause a denial of service device reload via crafted SIP packets, aka Bug IDs CSCum60442 and CSCum60447...

Code injection

The SIP IX implementation in Cisco TelePresence Video Communication Server VCS and Expressway Software before X8.1.1 allows remote attackers to cause a denial of service device reload via crafted SDP packets, aka Bug ID CSCuo42252...

CVE-2014-3370

Cisco TelePresence Video Communication Server VCS and Expressway Software before X8.1.1 allow remote attackers to cause a denial of service device reload via crafted SIP packets, aka Bug IDs CSCum60442 and CSCum60447...

CVE-2014-3369

The SIP IX implementation in Cisco TelePresence Video Communication Server VCS and Expressway Software before X8.1.1 allows remote attackers to cause a denial of service device reload via crafted SDP packets, aka Bug ID CSCuo42252...

CVE-2014-3370

CVE-2014-3370 affects Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway Software predating X8.1.1. A vulnerability in the SIP processing/module allows remote attackers to trigger a denial of service (device reload) via crafted SIP packets (Bug IDs CSCum60442, CSCum60447). D...

Multiple Vulnerabilities in Cisco TelePresence Video Communication Server and Cisco Expressway Software

Cisco TelePresence Video Communication Server VCS and Cisco Expressway Software includes the following vulnerabilities: Cisco TelePresence VCS and Cisco Expressway Crafted Packets Denial of Service Vulnerability Cisco TelePresence VCS and Cisco Expressway SIP IX Filter Denial of Service...

Juniper Junos SRX Series ALG 'flowd' Remote DoS (JSA10650)

According to its self-reported version number, the remote Juniper Junos SRX series device is affected by a denial of service vulnerability related to ALG Application Layer Gateway. A remote attacker can exploit this issue by sending a specially crafted SIP packet to an SRX series device, resultin...

Cisco IOS XE Software SIP DoS (cisco-sa-20140924-sip)

According to its self-reported version, the version of Cisco IOS XE running on the remote host is affected by a vulnerability in the Session Initiation Protocol SIP implementation due to improper handling of SIP messages. A remote attacker can exploit this issue by sending specially crafted SIP...

Cisco IOS Software SIP DoS (cisco-sa-20140924-sip)

According to its self-reported version, the version of Cisco IOS running on the remote host is affected by a vulnerability in the Session Initiation Protocol SIP implementation due to improper handling of SIP messages. A remote attacker can exploit this issue by sending specially crafted SIP...

Cisco IOS Software Network Address Translation (NAT) ALG Module DoS (cisco-sa-20140924-nat)

According to its self-reported version, the version of Cisco IOS running on the remote host is affected by a denial of service vulnerability in the Network Address Translation NAT application-layer gateway ALG module. This issue exists due to improper handling of multipart Session Description...

GNU Bash Environment Variable Handling RCE Vulnerability (Shellshock, SIP, CVE-2014-6271/CVE-2014-6278) - Active Check

GNU Bash is prone to a remote command execution RCE vulnerability dubbed Copyright C 2014 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is fre...

CVE-2014-3360

Cisco IOS 12.4 and 15.0 through 15.4 and IOS XE 3.1.xS, 3.2.xS, 3.3.xS, 3.4.xS, 3.5.xS, 3.6.xS, and 3.7.xS before 3.7.6S; 3.8.xS, 3.9.xS, and 3.10.xS before 3.10.1S; and 3.11.xS before 3.12S allow remote attackers to cause a denial of service device reload via a crafted SIP message, aka Bug ID...

CVE-2014-3361

The ALG module in Cisco IOS 15.0 through 15.4 does not properly implement SIP over NAT, which allows remote attackers to cause a denial of service device reload via multipart SDP IPv4 traffic, aka Bug ID CSCun54071...

Code injection

The ALG module in Cisco IOS 15.0 through 15.4 does not properly implement SIP over NAT, which allows remote attackers to cause a denial of service device reload via multipart SDP IPv4 traffic, aka Bug ID CSCun54071...