[NEWS] GNU oSIP URI Parsing Heap Overflows

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion The SecuriTeam alerts list - Free, Accurate, Independent. Get your security news from a reliable source...

CVE-2003-1114

The Session Initiation Protocol SIP implementation in Mediatrix Telecom VoIP Access Devices and Gateways running SIPv2.4 and SIPv4.3 firmware allows remote attackers to cause a denial of service or execute arbitrary code via crafted INVITE messages, as demonstrated by the OUSPG PROTOS c07-sip tes...

CVE-2003-1113

The Session Initiation Protocol SIP implementation in IPTel SIP Express Router 0.8.9 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted INVITE messages, as demonstrated by the OUSPG PROTOS c07-sip test suite...

CVE-2003-1114

The CVE-2003-1114 entry concerns Mediatrix Telecom SIP implementations on VoIP Access Devices and Gateways with SIPv2.4/SIPv4.3 firmware. A remote attacker can cause a denial of service or execute arbitrary code by sending crafted INVITE messages, as demonstrated by the OUSPG PROTOS c07-sip tests...

CVE-2003-1109

CVE-2003-1109 affects Cisco SIP implementations in IP Phone models 7940/7960, IOS 12.2 train, and Secure PIX 5.2.9–6.2.2. Crafted INVITE messages can cause denial of service and may allow arbitrary code execution, as demonstrated by the OUSPG PROTOS c07-sip test suite. Connected sources (Cisco ad...

CVE-2003-1108

CVE-2003-1108 affects the SIP implementation in Alcatel OmniPCX Enterprise 5.0 Lx. The issue allows remote attackers to cause a denial of service and potentially execute arbitrary code by sending crafted INVITE messages, as demonstrated by the OUSPG PROTOS c07-sip test suite. Connected sources co...

CVE-2003-1109

The Session Initiation Protocol SIP implementation in multiple Cisco products including IP Phone models 7940 and 7960, IOS versions in the 12.2 train, and Secure PIX 5.2.9 to 6.2.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted INVITE messages...

CVE-2003-1110

The CVE-2003-1110 issue affects the Columbia SIP User Agent (sipc) 1.74 and older builds prior to sipc 2.0 (build 2003-02-21). The vulnerability arises in its SIP Session Initiation Protocol handling, where crafted INVITE messages can cause a denial of service or allow execution of arbitrary code...

CVE-2003-1111

The CVE-2003-1111 entry covers the Session Initiation Protocol (SIP) implementation in multiple Dynamicsoft products (including y and certain AppEngine demo products). A remote attacker can cause denial of service or execute arbitrary code by sending crafted INVITE messages, as demonstrated by th...

CVE-2003-1112

The CVE-2003-1112 entry applies to the SIP implementation in Ingate Firewall and Ingate SIParator prior to version 3.1.3. A crafted INVITE message can trigger denial of service and, possibly, remote code execution, as demonstrated by the OUSPG PROTOS c07-sip tests. Remediation: upgrade to version...

CVE-2003-1115

The Session Initiation Protocol SIP implementation in Nortel Networks Succession Communication Server 2000, when using SIP-T, allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted INVITE messages, as demonstrated by the OUSPG PROTOS c07-sip test suit...

CVE-2003-1115

CVE-2003-1115 affects Nortel Networks Succession Communication Server 2000’s SIP-T implementation. The SIP stack allows remote attackers to trigger denial of service and potentially execute arbitrary code via crafted INVITE messages, as demonstrated by the OUSPG PROTOS c07-sip test suite. The ava...

CVE-2003-1113

The SIP vulnerability CVE-2003-1113 affects IPTel SIP Express Router (SER) 0.8.9 and earlier. Remote attackers can craft INVITE messages to trigger a denial of service and possibly execute arbitrary code, as demonstrated by the OUSPG PROTOS c07-sip test suite. The provided documents do not includ...

CVE-2003-1110

The Session Initiation Protocol SIP implementation in Columbia SIP User Agent sipc 1.74 and other versions before sipc 2.0 build 2003-02-21 allows remote attackers to cause a denial of service or execute arbitrary code via crafted INVITE messages, as demonstrated by the OUSPG PROTOS c07-sip test...

CVE-2003-1111: Undefined Security Weakness

The Session Initiation Protocol SIP implementation in multiple dynamicsoft products including y and certain demo products for AppEngine allows remote attackers to cause a denial of service or execute arbitrary code via crafted INVITE messages, as demonstrated by the OUSPG PROTOS c07-sip test suit...

CVE-2003-1108: Undefined Security Weakness

The Session Initiation Protocol SIP implementation in Alcatel OmniPCX Enterprise 5.0 Lx allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted INVITE messages, as demonstrated by the OUSPG PROTOS c07-sip test suite...

CVE-2003-1109: Undefined Security Weakness

The Session Initiation Protocol SIP implementation in multiple Cisco products including IP Phone models 7940 and 7960, IOS versions in the 12.2 train, and Secure PIX 5.2.9 to 6.2.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted INVITE messages...

CVE-2003-1113: Undefined Security Weakness

The Session Initiation Protocol SIP implementation in IPTel SIP Express Router 0.8.9 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted INVITE messages, as demonstrated by the OUSPG PROTOS c07-sip test suite...

CVE-2003-1115: Undefined Security Weakness

The Session Initiation Protocol SIP implementation in Nortel Networks Succession Communication Server 2000, when using SIP-T, allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted INVITE messages, as demonstrated by the OUSPG PROTOS c07-sip test suit...

CVE-2003-1112: Undefined Security Weakness

The Session Initiation Protocol SIP implementation in Ingate Firewall and Ingate SIParator before 3.1.3 allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted INVITE messages, as demonstrated by the OUSPG PROTOS c07-sip test suite...