PhonerLite 2.14 Digest Information Leak

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 I. Advisory Summary Title: SIP Digest Leak Information Disclosure in PhonerLite 2.14 SIP Soft Phone Date Published: March 30, 2014 Vendors contacted: Heiko Sommerfeldt, PhonerLite author Discovered by: Jason Ostrom Severity: Medium II. Vulnerability...

Cisco Patches Denial-of-Service Vulnerabilities in IOS

Cisco this week patched a handful of denial-of-service vulnerabilities in its IOS software. The security updates are part of a biannual release from Cisco; the next one is due in September. Five of the six patches handle denial-of-service vulnerabilities in its flagship IOS used in most of its...

Cisco IOS软件会话初始协议拒绝服务漏洞

CVECAN ID: CVE-2014-2106 Cisco IOS是多数思科系统路由器和网络交换机上使用的互联网络操作系统。 Cisco IOS 15.3M、IOS XE 3.10.xS在处理特制的SIP消息时存在错误，可导致内存资源耗尽，以及设备重载。 0 Cisco IOS XE 3.x Cisco已经为此发布了一个安全公告（cisco-sa-20140326-sip）以及相应补丁: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140326-sip...

CVE-2014-2106

Cisco IOS 15.3M before 15.33M2 and IOS XE 3.10.xS before 3.10.2S allow remote attackers to cause a denial of service device reload via crafted SIP messages, aka Bug ID CSCug45898...

Design/Logic Flaw

Cisco IOS 15.3M before 15.33M2 and IOS XE 3.10.xS before 3.10.2S allow remote attackers to cause a denial of service device reload via crafted SIP messages, aka Bug ID CSCug45898...

CVE-2014-2106

Cisco IOS 15.3M before 15.33M2 and IOS XE 3.10.xS before 3.10.2S allow remote attackers to cause a denial of service device reload via crafted SIP messages, aka Bug ID CSCug45898...

Cisco IOS Software Session Initiation Protocol Denial of Service Vulnerability

A vulnerability in the Session Initiation Protocol SIP implementation in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device. To exploit this vulnerability, affected devices must be configured to process SIP messages...

Cisco Unified SIP Phone 3905 unauthorized access

Undocumented TCP/7870 service...

Asterisk main/http.c DoS (AST-2014-001)

According to the version in its SIP banner, the version of Asterisk running on the remote host is potentially affected by a denial of service vulnerability. A stack overflow flaw exists when an HTTP request with a large number of cookie headers isn't properly validated. A remote attacker could...

Speedport DSL-Router Detection (SIP)

The script attempts to extract the version number from the SIP banner. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Asterisk PJSIP Channel Driver Options DoS (AST-2014-003)

According to the version in its SIP banner, the version of Asterisk running on the remote host is potentially affected by a denial of service vulnerability. A flaw exists in the PJSIP channel driver when the 'qualityfrequency' configuration is enabled on an AOR when the SIP server's challenges fo...

Asterisk SIP File Descriptor Exhaustion with chan_sip Session-Timers DoS (AST-2014-002)

According to the version in its SIP banner, the version of Asterisk running on the remote host is potentially affected by a denial of service vulnerability. A denial of service flaw exists with the SIP INVITE request handling. It is possible for a remote attacker to use all available file...

AST-2014-002: Denial of Service Through File Descriptor Exhaustion with chan_sip Session-Timers

Asterisk Project Security Advisory - AST-2014-002 Product Asterisk Summary Denial of Service Through File Descriptor Exhaustion with chansip Session-Timers Nature of Advisory Denial of Service Susceptibility Remote Authenticated or Anonymous Sessions Severity Moderate Exploits Known No Reported O...

Asterisk SIP INVITE请求处理拒绝服务漏洞

CVE ID:CVE-2014-2287 Asterisk是一款实现电话用户交换机（PBX）功能的自由软件、开源软件。 Asterisk处理特制的SIP INVITE请求时存在漏洞，由于没有正确释放文件描述符，允许远程攻击者利用漏洞提交恶意请求消耗完所有可用文件描述符，进行拒绝服务攻击。 0 Asterisk Open Source 1.8.26.0 Asterisk Open Source 11.8.0 Asterisk Open Source 12.1.0 Certified Asterisk 1.8.15-cert4 Certified Asterisk 11.6-cert1...

FreeBSD : asterisk -- multiple vulnerabilities (03159886-a8a3-11e3-8f36-0025905a4771)

The Asterisk project reports : Stack Overflow in HTTP Processing of Cookie Headers. Sending a HTTP request that is handled by Asterisk with a large number of Cookie headers could overflow the stack. You could even exhaust memory if you sent an unlimited number of headers in the request. Denial of...

Cisco 9900 Series IP Phone Crafted Header Unregister Vulnerability

According to its self-reported version, the version of the Cisco Unified IP Phone software running on the remote device does not properly process SIP headers. By sending a specially crafted SIP header to the device, a remote attacker may be able to cause the phone to unregister, resulting in a...

CVE-2014-0721

The Cisco Unified SIP Phone 3905 with firmware before 9.41 allows remote attackers to obtain root access via a session on the test interface on TCP port 7870, aka Bug ID CSCuh75574...

Design/Logic Flaw

The Cisco Unified SIP Phone 3905 with firmware before 9.41 allows remote attackers to obtain root access via a session on the test interface on TCP port 7870, aka Bug ID CSCuh75574...

CVE-2014-0721

The Cisco Unified SIP Phone 3905 with firmware before 9.41 allows remote attackers to obtain root access via a session on the test interface on TCP port 7870, aka Bug ID CSCuh75574...

CVE-2014-0721

The CVE-2014-0721 entry concerns the Cisco Unified SIP Phone 3905 with firmware before 9.4(1). The vulnerability stems from an undocumented test interface exposed on TCP port 7870, which an unauthenticated, remote attacker could use to gain root-level access to the device. Impact stated in source...