[Full-disclosure] MPM HP-180W VoIP wireless desktop phone undocumented port UDP/9090

I disclosed the following issue at ShmooCon 2006 http://www.shmoocon.org/ during my "VoIP Wireless Phone Security Analysis" presentation. Thanks, --scm =============================================================== DATE: 16 January, 2006 VENDOR: MPM - http://www.mpn.com.tw VENDOR NOTIFIED: 7...

Interaction SIP proxy VoIP gateway memory corruption

Heap memory corruption on SIP request processing...

CVE-2005-4050

Buffer overflow in multiple Multi-Tech Systems MultiVOIP devices with firmware before x.08 allows remote attackers to execute arbitrary code via a long INVITE field in a Session Initiation Protocol SIP packet...

[Full-disclosure] Buffer Overflow in MultiTech VoIP Implementations

SecurityLab Technologies, Inc. --- www.securitylab.net --- Security Advisory Advisory Name: Buffer Overflow in MultiTech VoIP Implementations Release Date: December 05, 2005 Application: MultiVoIP Gateway Platform: Multiple Severity: Moderate Author: Ejovi Nuwere SLABresearchATsecuritylab.net...

MultiTech MultiVoIP VoIP gateway SIP buffer overflow

Buffer overflow on oversized SIP packet INVITE field...

CVE-2005-3989

Memory leak in Avaya TN2602AP IP Media Resource 320 circuit pack before vintage 9 firmware allows remote attackers to cause a denial of service memory consumption via crafted VoIP packets...

CVE-2005-3989

Memory leak in Avaya TN2602AP IP Media Resource 320 circuit pack before vintage 9 firmware allows remote attackers to cause a denial of service memory consumption via crafted VoIP packets...

CVE-2005-3989

CVE-2005-3989 concerns a memory leak in Avaya TN2602AP IP Media Resource 320 circuit pack on firmware older than vintage 9. The issue allows remote attackers to induce a denial of service through crafted VoIP packets, with network access, no authentication, and resulting in memory consumption lea...

CVE-2005-3989: Undefined Security Weakness

Memory leak in Avaya TN2602AP IP Media Resource 320 circuit pack before vintage 9 firmware allows remote attackers to cause a denial of service memory consumption via crafted VoIP packets...

CVE-2005-3803

Cisco IP Phone VoIP 7920 1.08 contains certain hard-coded "fixed" public and private SNMP community strings that cannot be changed, which allows remote attackers to obtain sensitive information...

CVE-2005-3803

Cisco IP Phone VoIP 7920 1.08 contains certain hard-coded "fixed" public and private SNMP community strings that cannot be changed, which allows remote attackers to obtain sensitive information...

CVE-2005-3804

The CVE-2005-3804 family is tied to Cisco IP Phone 7920 (VoIP) 1.0(8), where the device listens on UDP port 17185 to support a VxWorks debugger. This exposes a WDB debug service that remote attackers can use to obtain sensitive information and cause a denial of service. Related entries (Wind Rive...

CVE-2005-3803

Cisco IP Phone 7920 (VoIP) 1.0(8) is affected by hard-coded public and private SNMP community strings that cannot be changed, enabling potential remote information disclosure. The issue is documented across NVD/Nessus and Cisco advisories, with a vendor alert suggesting that fixed SNMP communitie...

CVE-2005-3804: Undefined Security Weakness

Cisco IP Phone VoIP 7920 1.08 listens to UDP port 17185 to support a VxWorks debugger, which allows remote attackers to obtain sensitive information and cause a denial of service...

CVE-2005-3803: Use of Hard-coded Credentials

Cisco IP Phone VoIP 7920 1.08 contains certain hard-coded "fixed" public and private SNMP community strings that cannot be changed, which allows remote attackers to obtain sensitive information...

CVE-2005-3719

Hitachi IP5000 VOIP WIFI Phone 1.5.6 has a hard-coded administrator password of "0000", which allows attackers with physical access to obtain sensitive information and modify the phone's configuration...

CVE-2005-3720

The default index page in the HTTP server in Hitachi IP5000 VOIP WIFI Phone 1.5.6 lists sensitive information such as software versions...

CVE-2005-3721

The default configuration of the HTTP server in Hitachi IP5000 VOIP WIFI Phone 1.5.6 does not require authentication for sensitive configuration pages, which allows remote attackers to modify configuration...

CVE-2005-3723

Hitachi IP5000 VOIP WIFI Phone 1.5.6 does not allow the user to disable access to 1 SNMP or 2 TCP port 3390, which allows remote attackers to modify configuration using CVE-2005-3722, or access the Unidata Shell to obtain sensitive information or cause a denial of service...

CVE-2005-3724

Zyxel P2000W Version 1 VOIP WIFI Phone Wj.00.10 allows remote attackers to obtain sensitive information and possibly cause a denial of service via a direct connection to UDP port 9090, which is undocumented and does not require authentication...