TOM-Skype Detection

TOM-Skype is a variant of the popular 'Skype' VoIP application done in conjunction with TOM Online, a popular Chinese Internet Provider. The remote version of TOM-Skype filters out some incoming keywords that the official version of Skype does not, and apparently does not guarantee the...

CVE-2008-3801

Unspecified vulnerability in the Session Initiation Protocol SIP implementation in Cisco IOS 12.2 through 12.4 and Unified Communications Manager 4.1 through 6.1, when VoIP is configured, allows remote attackers to cause a denial of service device or process reload via unspecified valid SIP...

CVE-2008-3799

Memory leak in the Session Initiation Protocol SIP implementation in Cisco IOS 12.2 through 12.4, when VoIP is configured, allows remote attackers to cause a denial of service memory consumption and voice-service outage via unspecified valid SIP messages...

CVE-2008-3800

Unspecified vulnerability in the Session Initiation Protocol SIP implementation in Cisco IOS 12.2 through 12.4 and Unified Communications Manager 4.1 through 6.1, when VoIP is configured, allows remote attackers to cause a denial of service device or process reload via unspecified valid SIP...

Design/Logic Flaw

Unspecified vulnerability in the Session Initiation Protocol SIP implementation in Cisco IOS 12.2 through 12.4, when VoIP is configured, allows remote attackers to cause a denial of service device reload via unspecified valid SIP messages, aka Cisco bug ID CSCsk42759, a different vulnerability th...

Design/Logic Flaw

Unspecified vulnerability in the Session Initiation Protocol SIP implementation in Cisco IOS 12.2 through 12.4 and Unified Communications Manager 4.1 through 6.1, when VoIP is configured, allows remote attackers to cause a denial of service device or process reload via unspecified valid SIP...

Memory corruption

Memory leak in the Session Initiation Protocol SIP implementation in Cisco IOS 12.2 through 12.4, when VoIP is configured, allows remote attackers to cause a denial of service memory consumption and voice-service outage via unspecified valid SIP messages...

CVE-2008-3801

Unspecified vulnerability in the Session Initiation Protocol SIP implementation in Cisco IOS 12.2 through 12.4 and Unified Communications Manager 4.1 through 6.1, when VoIP is configured, allows remote attackers to cause a denial of service device or process reload via unspecified valid SIP...

CVE-2008-3802

Unspecified vulnerability in the Session Initiation Protocol SIP implementation in Cisco IOS 12.2 through 12.4, when VoIP is configured, allows remote attackers to cause a denial of service device reload via unspecified valid SIP messages, aka Cisco bug ID CSCsk42759, a different vulnerability th...

CVE-2008-3802

CVE-2008-3802 refers to DoS in Cisco IOS SIP handling (12.2–12.4) when VoIP is enabled, triggered by processing certain valid SIP messages, potentially causing a device reload. Related CVEs CVE-2008-3800 and CVE-2008-3801 cover additional SIP DoS issues in IOS/CUCM; the issues are tracked under C...

CVE-2008-3800

Unspecified vulnerability in the Session Initiation Protocol SIP implementation in Cisco IOS 12.2 through 12.4 and Unified Communications Manager 4.1 through 6.1, when VoIP is configured, allows remote attackers to cause a denial of service device or process reload via unspecified valid SIP...

Security Best Practice: Protect Yourself from VoIP Denial of Service Vulnerabilities

VoIP opens voice communications to the same kinds of security threats that imperil data communications. Attacks on data communications can come through the IP voice infrastructure and vice versa. Denial of service attacks targeting weak VoIP elements could flood the network with voice traffic,...

Asterisk IAX2 (IAX) POKE Request Saturation Resource Exhaustion Remote DoS

The version of Asterisk running on the remote host consumes an IAX2 call number while waiting for an ACK packet in response to a PONG packet. By flooding the affected service with POKE requests, an unauthenticated, remote attacker can leverage this issue to exhaust all available call numbers and...

Asterisk IAX2 FWDOWNL Request Spoofing Remote DoS

The firmware download protocol implemented in the version of Asterisk running on the remote host does not initiate a handshake. By spoofing an IAX2 FWDOWNL request, an unauthenticated, remote attacker may be able to leverage this issue to flood a third-party host with unwanted firmware packets fr...

Asterisk IAX 'POKE'请求远程拒绝服务漏洞

BUGTRAQ ID: 30321 CNCAN ID：CNCAN-2008072205 Asterisk是开放源码的软件PBX，支持各种VoIP协议和设备。 Asterisk处理多个IAX 'POKE'请求存在问题，远程攻击者可以利用漏洞对应用程序进行拒绝服务攻击。 攻击者可以发送持续的'POKE'请求流可导致服务程序消耗大量处理器资源，造成应用程序停止响应，触发拒绝服务攻击。 Asterisk Asterisk Business Edition C.1.8.1 Asterisk Asterisk Business Edition C.1.6.2 Asterisk Asterisk...

reSIProcate 1.3.2 - Remote Denial of Service (PoC)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Remote DoS in reSIProcate MU-200807-01 July 10, 2008 http://labs.mudynamics.com/advisories.html Affected Products/Versions: repro SIP proxy/registrar 1.3.2 http://www.resiprocate.org/ReSIProcate1.3.2Release Any product using the reSIProcate SIP stack...

Asterisk SIP Remote Authentication Bypass

The version of Asterisk running on the remote host allows unauthenticated calls via the SIP channel driver. Using a specially crafted From header, a remote attacker can bypass authentication and make calls into the context specified in the 'general' section of 'sip.conf'. %NASLMINLEVEL 70300 C...

Asterisk IAX2 Multiple Method Handshake Spoofing DoS

The version of Asterisk running on the remote host does not properly validate an IAX2 handshake. By spoofing NEW and ACK messages, an unauthenticated, remote attacker may be able to leverage this issue to flood a third-party host with packets from the affected host containing audio data. C Tenabl...

[SECURITY] Fedora 7 Update: asterisk-1.4.19.1-1.fc7

Asterisk is a complete PBX in software. It runs on Linux and provides all of the features you would expect from a PBX and more. Asterisk does voice over IP in three protocols, and can interoperate with almost all standards-based telephony equipment using relatively inexpensive hardware...

[SECURITY] Fedora 7 Update: speex-1.2-0.3.beta1

Speex is a patent-free compression format designed especially for speech. It is specialized for voice communications at low bit-rates in the 2-45 kbps range. Possible applications include Voice over IP VoIP, Internet audio streaming, audio books, and archiving of speech data e.g. voice mail...