1293 matches found
sip-pwn.txt
SIP, the IETF endorsed VoIP signaling protocol, is currently used to establish and manage VoIP calls. Many security issues have been addressed until know about the security of VoIP due to the large numbers of attacks coming from the traditional IP networks, but none have addressed the securing th...
[Full-disclosure] Owning the internal network with SIP (part 1) and a Linksys Phone
SIP, the IETF endorsed VoIP signaling protocol, is currently used to establish and manage VoIP calls. Many security issues have been addressed until know about the security of VoIP due to the large numbers of attacks coming from the traditional IP networks, but none have addressed the securing th...
BT Home Flub: Pwnin the BT Home Hub
http://www.gnucitizen.org/blog/bt-home-flub-pwnin-the-bt-home-hub The BT Home Hub, which is probably the most popular home router in the UK, is susceptible to critical vulnerabilities. BT's plan is to sneak one of this boxes into every UK home. Not only does the BT Home Hub support broadband but...
Ekiga VoIP/video application DoS
SIPURL::GetHostAddress invalid memory allocation...
S21SEC-036-EN Ekiga <= 2.0.5 Denial of service
S21Sec Advisory - Title: Ekiga Denial of Service ID: S21SEC-036-en Severity: Medium - Remote DoS History: 14.May.2007 Vulnerability discovered 09.Jul.2007 Vendor contacted Scope: Application Denial of Service Platforms: Any Author: Jose Miguel Esparza [email protected] URL:...
cisco-sql.txt
SUMMARY ======= A SQL injection vulnerability exists in the Log On page of the web interface for Cisco CallManager AKA Unified Communications Manager. An unauthenticated attacker who is able to access the Log On page could exploit this vulnerability to run arbitrary SQL commands as the logged in...
[Full-disclosure] DOS vulnerability on Thomson SIP phone ST 2030 using an empty packet
MADYNES Security Advisory : Remote DOS on Thomson SIP phone ST 2030 using an empty packet Date of Discovery 15 February, 2007 Vendor was notified on 1 March 2007 ID: KIPH10 Synopsis After sending an empty message the device looks functional but in fact does not respond to any event provoking a Do...
[Full-disclosure] DOS vulnerability on Thomson SIP phone ST 2030 using the TO Header
MADYNES Security Advisory : Remote DOS on Thomson SIP phone ST 2030 Date of Discovery 15 February, 2007 Vendor was notified on 1 March 2007 ID: KIPH9 Synopsis After sending a message where the TO URI field is crafted, the device looks functional but in fact does not respond to any event provoking...
[Full-disclosure] DOS vulnerability on Thomson SIP phone ST 2030 using the VIA Header
MADYNES Security Advisory : Remote DOS on Thomson SIP phone ST 2030 Date of Discovery 15 February, 2007 Vendor was notified on 1 March 2007 ID: KIPH8 Synopsis After sending a message where the a space is replaced by a slash after the SIP version in the VIA, the device looks functional but in fact...
eCentrex VOIP Client UACOMX.OCX ActiveX控件栈溢出漏洞
BUGTRAQ ID: 25383 eCentrex VOIP Client是一款网络电话客户端软件。 eCentrex VOIP Client的ActiveX控件实现上存在缓冲区溢出漏洞，远程攻击者可能利用此漏洞控制用户系统。 eCentrex SIP UA Com模块（euacom.dll）在处理传送给eCentrex VOIP Client组件ActiveX控件（uacomx.ocx）的ReInit方式的超长参数时存在栈溢出漏洞，如果用户受骗访问了恶意网页，就可能触发这个溢出，导致执行任意指令。 eCentrex VOIP Client ActiveX 2.0.1...
grandstream-sip.txt
While playing with the SIP Madynes stateful fuzzer for a description see http://hal.inria.fr/inria-00166947/en, we have realized that some SIP stack engines have serious bugs allowing to an attacker to automatically make a remote phone accept the call without ringing and without asking the user t...
Buffer overflow
Buffer overflow in the IUAComFormX ActiveX control in uacomx.ocx 2.0.1 in the eCentrex VOIP Client module allows remote attackers to execute arbitrary code via a long Username argument to the ReInit method...
CVE-2007-4489
The CVE-2007-4489 issue affects the IUAComFormX ActiveX control in uacomx.ocx 2.0.1, used by the eCentrex VOIP Client module. The root cause is a buffer overflow triggered by a long Username argument to the ReInit method, which can allow remote code execution. The available connected documents co...
Asterisk VoIP server Skinny protocol resources aexhaustions
SIP dialog history is stored in memory regardless of settings, leading to memory exhaustion...
eCentrex VOIP Client module (uacomx.ocx 2.0.1) Remote BOF Exploit
No description provided by source. !-- 17/08/2007 04.41.37 eCentrex VOIP Client module uacomx.ocx 2.0.1 remote buffer overflow exploit ie6 / xp sp2 passing more than 164 chars to ReInit method in Username argument EAX 41414131 ECX 0013D444 ASCII "AAAAAAAA... EDX 00000000 EBX 00000000 ESP 0013D3A0...
eCentrex VOIP Client module (uacomx.ocx 2.0.1) Remote BOF Exploit
Exploit for unknown platform in category remote exploits ================================================================= eCentrex VOIP Client module uacomx.ocx 2.0.1 Remote BOF Exploit ================================================================= 'metasploit one, 456 bytes - cmd /c net user...
cisco-dos.txt
MADYNES Security Advisory : stateful SIP remote DOS on Cisco 7940 Date of Discovery 3 February, 2007 ID: KIPH5 Synopsis After sending a series of three SIP messages the device reboots. The phone does not check properly the state engine in the SIP stack The vendor was informed in March 2007 and...
eCentrex VOIP Client module - uacomx.ocx 2.0.1 Remote Buffer Overflow
eCentrex VOIP Client module - uacomx.ocx 2.0.1 Remote Buffer Overflow 'metasploit one, 456 bytes - cmd /c net user su tzu /add & net localgroup Administrators su /add scode =...
