CVE-2007-2293

Multiple stack-based buffer overflows in the processsdp function in chansip.c of the SIP channel T.38 SDP parser in Asterisk before 1.4.3 allow remote attackers to execute arbitrary code via a long 1 T38FaxRateManagement or 2 T38FaxUdpEC SDP parameter in an SIP message, as demonstrated using SIP...

CVE-2007-2293

Multiple stack-based buffer overflows in the processsdp function in chansip.c of the SIP channel T.38 SDP parser in Asterisk before 1.4.3 allow remote attackers to execute arbitrary code via a long 1 T38FaxRateManagement or 2 T38FaxUdpEC SDP parameter in an SIP message, as demonstrated using SIP...

CVE-2007-2297

The SIP channel driver chansip in Asterisk before 1.2.18 and 1.4.x before 1.4.3 does not properly parse SIP UDP packets that do not contain a valid response code, which allows remote attackers to cause a denial of service crash...

Cross site request forgery (csrf)

The Linksys SPA941 VoIP Phone allows remote attackers to cause a denial of service device reboot via a 0377 0xff character in the From header, and possibly certain other locations, in a SIP INVITE request...

CVE-2007-2270

CVE-2007-2270 affects the Linksys SPA941 VoIP Phone. The vulnerability is triggered by a 0xff character in the SIP INVITE From header (and possibly other locations), leading to a denial of service via device reboot. The available documents provide the impact and affected component but do not spec...

CVE-2007-2270

The Linksys SPA941 VoIP Phone allows remote attackers to cause a denial of service device reboot via a 0377 0xff character in the From header, and possibly certain other locations, in a SIP INVITE request...

[Full-disclosure] ASA-2007-011: Multiple problems in SIP channel parser handling response codes

Asterisk Project Security Advisory - ASA-2007-011 +------------------------------------------------------------------------+ | Product | Asterisk | |--------------------+---------------------------------------------------| | Summary | Multiple problems in SIP channel parser handling | | | respons...

Asterisk multiple security vulnerabilities

Multiple buffer overflows on T.38 SDP SIP channels parsing. DoS in administration interface. Multiple security vulnerabilities in parsing SIP replies...

Heap overflow

Heap-based buffer overflow in the VideoConference framework in Apple Mac OS X 10.3.9 through 10.4.9 allows remote attackers to execute arbitrary code via a "crafted SIP packet when initializing an audio/video conference"...

CVE-2007-0746

Heap-based buffer overflow in the VideoConference framework in Apple Mac OS X 10.3.9 through 10.4.9 allows remote attackers to execute arbitrary code via a "crafted SIP packet when initializing an audio/video conference"...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in freePBX 2.2.x allow remote attackers to inject arbitrary web script or HTML via the 1 From, 2 To, 3 Call-ID, 4 User-Agent, and unspecified other SIP protocol fields, which are stored in /var/log/asterisk/full and displayed by...

CVE-2007-2191

Multiple cross-site scripting XSS vulnerabilities in freePBX 2.2.x allow remote attackers to inject arbitrary web script or HTML via the 1 From, 2 To, 3 Call-ID, 4 User-Agent, and unspecified other SIP protocol fields, which are stored in /var/log/asterisk/full and displayed by...

CVE-2007-0746

CVE-2007-0746 is a heap-based buffer overflow in Apple’s VideoConference framework affecting Mac OS X 10.3.9–10.4.9. An attacker can trigger code execution by sending a crafted SIP packet during VoIP conference initialization. Impact: remote code execution with no user interaction. Mitigation: Ap...

CVE-2007-2191

CVE-2007-2191 describes multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.2.x . The flaws allow remote attackers to inject arbitrary web script or HTML via SIP-related fields (1) From, (2) To, (3) Call-ID, (4) User-Agent, and potentially other SIP headers, with the malicious data s...

CVE-2007-2191

Multiple cross-site scripting XSS vulnerabilities in freePBX 2.2.x allow remote attackers to inject arbitrary web script or HTML via the 1 From, 2 To, 3 Call-ID, 4 User-Agent, and unspecified other SIP protocol fields, which are stored in /var/log/asterisk/full and displayed by...

CVE-2007-0746

Heap-based buffer overflow in the VideoConference framework in Apple Mac OS X 10.3.9 through 10.4.9 allows remote attackers to execute arbitrary code via a "crafted SIP packet when initializing an audio/video conference"...

Linksys SPA941 - Remote Reboot (Denial of Service)

!/usr/bin/perl use IO::Socket; die "Usage $0 " unless $ARGV2; die "Usage $0 " unless $ARGV0; my $sock = new IO::Socket::INET LocalHost = $ARGV2, LocalPort = $ARGV3, Proto = 'udp'; $socket=new IO::Socket::INET-newPeerAddr=$ARGV1, PeerPort= '5060', Proto='udp', LocalAddr=$ARGV2, LocalPort='5061';...

Linksys SPA941 - Remote Reboot (Denial of Service)

Linksys SPA941 - Remote Reboot Denial of Service !/usr/bin/perl use IO::Socket; die "Usage $0 " unless $ARGV2; die "Usage $0 " unless $ARGV0; my $sock = new IO::Socket::INET LocalHost = $ARGV2, LocalPort = $ARGV3, Proto = 'udp'; $socket=new IO::Socket::INET-newPeerAddr=$ARGV1, PeerPort= '5060',...

Linksys SPA941 (remote reboot) Remote Denial of Service Exploit

Exploit for hardware platform in category dos / poc =============================================================== Linksys SPA941 remote reboot Remote Denial of Service Exploit =============================================================== !/usr/bin/perl use IO::Socket; die "Usage $0 " unless...

[Full-disclosure] Linksys SPA941 remote DOS with \377 character

MADYNES Security Advisory http://madynes.loria.fr/ http://madynes.loria.fr Title: Linksys SPA941 remote DOS with 377 character Discovery Date: 01/02/2007 Vendor notification: 4/04/2007 and 17/04/2007 Release Date: 24/04/2007 Severity: Moderate - Denial of Service Advisory ID:KIHP3 Vulnerability i...