Design/Logic Flaw

The Nortel UNIStim IP Softphone 2050, IP Phone 1140E, and additional Nortel products from the IP Phone, Business Communications Manager BCM, and other product lines allow remote attackers to eavesdrop on the physical environment via an Open Audio Stream message that enables "surveillance mode."...

CVE-2007-5639

The Nortel UNIStim IP Softphone 2050, IP Phone 1140E, and other Nortel IP Phone, Mobile Voice Client, and WLAN Handsets products allow remote attackers to cause a denial of service device hang via a flood of Mute and UnMute messages that have a spoofed source IP address for the Signaling Server...

Code injection

The Nortel UNIStim IP Softphone 2050, IP Phone 1140E, and other Nortel IP Phone, Mobile Voice Client, and WLAN Handsets products allow remote attackers to cause a denial of service device hang via a flood of Mute and UnMute messages that have a spoofed source IP address for the Signaling Server...

CVE-2007-5638

The Nortel UNIStim IP Softphone 2050, IP Phone 1140E, and additional Nortel products from the IP Phone, Business Communications Manager BCM, and other product lines, use only 65536 different values in the 32-bit ID number field of an RUDP datagram, which makes it easier for remote attackers to...

CVE-2007-5637

The CVE-2007-5637 entry applies to Nortel UNIStim IP Softphone 2050, IP Phone 1140E, and related Nortel products (IP Phone, BCM, and other lines). The vulnerability is described as remote eavesdropping on the physical environment via an Open Audio Stream message that enables a surveillance mode. ...

CVE-2007-5639

The Nortel UNIStim IP Softphone 2050, IP Phone 1140E, and other Nortel IP Phone, Mobile Voice Client, and WLAN Handsets products allow remote attackers to cause a denial of service device hang via a flood of Mute and UnMute messages that have a spoofed source IP address for the Signaling Server...

CVE-2007-5639

The CVE-2007-5639 entry concerns Nortel UNIStim family devices (Nortel UNIStim IP Softphone 2050, IP Phone 1140E, plus other Nortel IP Phone, Mobile Voice Client, and WLAN Handsets). The vulnerability allows remote attackers to cause a denial of service (device hang) by sending a flood of Mute/Un...

phone-sqlxss.txt

In a previous post http://seclists.org/fulldisclosure/2007/Oct/0174.html , we have seen how XSS injection can be performed over SIP to inject malicious JavaScript into the browser of an user that check the call history of his phone. In this post, we will detail how XSS injection can be performed...

Nortel IP Phone forced re-authentication

COMPASS SECURITY ADVISORY http://www.csnc.ch/ Product: IP Phone Vendor: Nortel Subject: IP Phone forced re-authentication Risk: High Effect: Currently exploitable Author: Daniel Stirnimann daniel.stirnimann at csnc dot ch Date: October, 18th 2007 Introduction: ------------- The UNIStim...

Nortel IP Phone Flooding Denial of Service

COMPASS SECURITY ADVISORY http://www.csnc.ch/ Product: IP Phone Vendor: Nortel Subject: IP Phone Flooding Denial of Service Risk: High Effect: Currently exploitable Author: Daniel Stirnimann daniel.stirnimann at csnc dot ch Date: October, 18th 2007 Introduction: ------------- A malicious user who...

Nortel Unistream IP Phone / Softphone / Communication Server multiple security vulnerabilities

Buffer overflow, eavesdroping. multiple DoS conditions...

Nortel IP Phone Surveillance Mode

COMPASS SECURITY ADVISORY http://www.csnc.ch/ Product: IP Phone Vendor: Nortel Subject: IP Phone Surveillance Mode Risk: High Effect: Currently exploitable Author: Daniel Stirnimann daniel.stirnimann at csnc dot ch Date: October, 18th 2007 Introduction: ------------- An IP phone can be put into...

Nortel Networks - Multiple UNIStim VoIP Products Remote Eavesdrop Vulnerabilities

source: https://www.securityfocus.com/bid/26120/info Multiple Nortel Networks UNIStim VoIP telephony products are prone to a remote vulnerability that may allow eavesdropping. Attackers can exploit this issue to open an audio channel with the phone's microphone. This will allow attackers to...

Nortel Networks - Multiple UNIStim VoIP Products Remote Eavesdrop Vulnerabilities

Nortel Networks - Multiple UNIStim VoIP Products Remote Eavesdrop Vulnerabilities source: https://www.securityfocus.com/bid/26120/info Multiple Nortel Networks UNIStim VoIP telephony products are prone to a remote vulnerability that may allow eavesdropping. Attackers can exploit this issue to ope...

CVE-2007-5493

CVE-2007-5493 affects Microsoft Windows Mobile 2005 Pocket PC Phone Edition. The vulnerability exists in the SMS handler where a specially crafted WAP PUSH can cause the PDU to be decoded incorrectly, allowing an attacker to hide the original sender field of an SMS without user interaction. The c...

Cross site scripting

Cross-site scripting XSS vulnerability in the Linksys SPA941 VoIP Phone with firmware 5.1.8 allows remote attackers to inject arbitrary web script or HTML via the From header in a SIP message...

CVE-2007-4924

The Open Phone Abstraction Library opal, as used by 1 Ekiga before 2.0.10 and 2 OpenH323 before 2.2.4, allows remote attackers to cause a denial of service crash via an invalid Content-Length header field in Session Initiation Protocol SIP packets, which causes a \0 byte to be written to an...

CVE-2007-4924

Removed by vendor...

CVE-2007-4924

The Open Phone Abstraction Library opal, as used by 1 Ekiga before 2.0.10 and 2 OpenH323 before 2.2.4, allows remote attackers to cause a denial of service crash via an invalid Content-Length header field in Session Initiation Protocol SIP packets, which causes a \0 byte to be written to an...

Exploits DOS vulnerability on Thomson SIP phone ST 2030 using an empty packet

No description provided by source. !/usr/bin/perl use IO::Socket::INET; die "Usage $0 dst port username" unless $ARGV2; $socket=new IO::Socket::INET-newPeerPort=$ARGV1, Proto='udp', PeerAddr=$ARGV0; $msg = ""; $socket-send$msg;...