Design/Logic Flaw

rutil/dns/DnsStub.cxx in ReSIProcate 1.3.2, as used by repro, allows remote attackers to cause a denial of service daemon crash via a SIP 1 INVITE or 2 OPTIONS message with a long domain name in a request URI, which triggers an assert error...

CVE-2008-3210

rutil/dns/DnsStub.cxx in ReSIProcate 1.3.2, as used by repro, allows remote attackers to cause a denial of service daemon crash via a SIP 1 INVITE or 2 OPTIONS message with a long domain name in a request URI, which triggers an assert error...

CVE-2008-3210

The CVE-2008-3210 entry concerns ReSIProcate 1.3.2 (rutil/dns/DnsStub.cxx). The issue is a denial-of-service condition: remote attackers can trigger a daemon crash by sending SIP requests (INVITE or OPTIONS) with an excessively long domain name in the request URI, which causes an assert failure. ...

eStara Softphone <= 3.0.1.46 (SIP) Remote Buffer Overflow Exploit

No description provided by source. / eStara Softphone buffer overflow exploit tested on : eStara Softphone 3.0.1.14 |||||| eStara Softphone 3.0.1.46 Vender website : http://www.estara.com/softphone/softph.exe Run this application, then use nc to send builded packet : nc -u 127.0.0.1 5060...

ReSIProcate INVITE/OPTIONS消息DNS解析器远程拒绝服务漏洞

BUGTRAQ ID: 30194 CNCAN ID：CNCAN-2008071509 ReSIProcate是一款开源SIP协议栈实现。 ReSIProcate当处理用户提供的URI时缺少充分的边界检查，远程攻击者可以利用漏洞对服务程序进行拒绝服务攻击。 当超长域名传递给DNS解析器，可触发一个'Assert'错误，应用程序会崩溃，目前不确定是否能执行任意代码。 ReSIProcate 1.3.2 升级程序： ReSIProcate ReSIProcate 1.3.2 ReSIProcate resiprocate-1.3.3.tar.gz...

reSIProcate 1.3.2 Remote Denial of Service PoC

No description provided by source. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Remote DoS in reSIProcate MU-200807-01 July 10, 2008 http://labs.mudynamics.com/advisories.html Affected Products/Versions: repro SIP proxy/registrar 1.3.2 http://www.resiprocate.org/ReSIProcate1.3.2Release Any produ...

reSIProcate 1.3.2 Remote Denial of Service PoC

Exploit for multiple platform in category dos / poc ============================================== reSIProcate 1.3.2 Remote Denial of Service PoC ============================================== -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Remote DoS in reSIProcate MU-200807-01 July 10, 2008...

reSIProcate 1.3.2 - Remote Denial of Service (PoC)

reSIProcate 1.3.2 - Remote Denial of Service PoC -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Remote DoS in reSIProcate MU-200807-01 July 10, 2008 http://labs.mudynamics.com/advisories.html Affected Products/Versions: repro SIP proxy/registrar 1.3.2...

reSIProcate 1.3.2 - Remote Denial of Service (PoC)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Remote DoS in reSIProcate MU-200807-01 July 10, 2008 http://labs.mudynamics.com/advisories.html Affected Products/Versions: repro SIP proxy/registrar 1.3.2 http://www.resiprocate.org/ReSIProcate1.3.2Release Any product using the reSIProcate SIP stack...

Code injection

Nortel SIP Multimedia PC Client 4.x MCS5100 and MCS5200 does not limit the number of concurrent sessions, which allows attackers to cause a denial of service resource consumption via a large number of sessions...

CVE-2008-3157

Nortel SIP Multimedia PC Client 4.x MCS5100 and MCS5200 does not limit the number of concurrent sessions, which allows attackers to cause a denial of service resource consumption via a large number of sessions...

CVE-2008-3157

Nortel SIP Multimedia PC Client 4.x MCS5100 and MCS5200 does not limit the number of concurrent sessions, which allows attackers to cause a denial of service resource consumption via a large number of sessions...

CVE-2008-3157

CVE-2008-3157 affects Nortel SIP Multimedia PC Client 4.x MCS5100 and MCS5200. The vulnerability stems from not limiting concurrent sessions, enabling denial of service via a large number of sessions. The NVD lists a CVSS v2 base score of 5.0 (Medium) with network access, low attack complexity, a...

[SECURITY] Fedora 9 Update: sipp-3.1-2.fc9

SIPp is a free Open Source test tool / traffic generator for the SIP protoc ol. It includes a few basic SipStone user agent scenarios UAC and UAS and establishes and releases multiple calls with the INVITE and BYE methods. It can also reads custom XML scenario files describing from very simple to...

[SECURITY] Fedora 8 Update: sipp-3.1-2.fc8

SIPp is a free Open Source test tool / traffic generator for the SIP protoc ol. It includes a few basic SipStone user agent scenarios UAC and UAS and establishes and releases multiple calls with the INVITE and BYE methods. It can also reads custom XML scenario files describing from very simple to...

Avaya产品WEB管理接口输入验证漏洞

BUGTRAQ ID: 29939,29938 Avaya是一家提供IP通信以及面向企业的通信网络设计、建造、部署和管理的厂商。 Avaya的Communication Manager、Message Storage Server和Avaya SIP Enablement Services 产品的WEB管理接口存在输入验证错误，如果远程攻击者向上述产品的WEB管理接口提交了恶意请求的话，就可能导致读取敏感信息或执行任意指令。 0 AVAYA Communication Manager 4.x AVAYA Communication Manager 3.1.x AVAYA SIP...

Avaya Communication Manager存在多个安全漏洞

BUGTRAQ ID: 29939 CNCAN ID：CNCAN-2008062702 Avaya Communication Manager是一款IP语音通信解决方案。 Avaya Communication Manager WEB管理接口存在多个安全问题，远程攻击者可以利用漏洞执行任意代码，提升特权，获得敏感信息等攻击。 -配置数据查看或恢复信任凭证时存在问题可导致提升特权。 -配置本地数据查看和恢复参数时可导致以登录用户进程权限执行系统命令。 -配置存在问题可导致系统信息恢复，包括加密密码信息。 -无需验证从对象文件夹中执行脚本。 -无需验证可执行不需要的默认应用程序。...

Nortel SIP多媒体PC客户端会话处理拒绝服务漏洞

Nortel Networks公司推出的SIP多媒体PC客户端是一个功能全面的多媒体即时通讯工具。 SIP多媒体PC客户端没有限制可生成的连接或活动窗口的数量，未经认证的远程攻击者可以创建大量会话，直到系统无法处理，导致耗尽客户端系统上的可用资源。 Nortel Networks 多媒体PC客户端SIP电话 4.x Novell ------ 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://support.novell.com/security-alerts...

AOL AIM SIPFoundry sipXtapi RTCP Processing Heap Overflow Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of AOL AIM. Successful exploitation requires the victim to accept a Video Messaging session with the attacker. The specific flaw exists in the SIP protocol implementation library, sipXtapi.dll. If a...

AOL AIM SIPFoundry sipXtapi RTP Processing Heap Overflow Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of any communication application utilizing the SIP Foundry API. This includes vendors such as AOL, Yahoo, Skype, Oracle, Nortel and more. Authentication is not required to exploit these vulnerabilitie...