F5 BIG-IP SIP Message Handling Denial of Service Vulnerability

The F5 BIG-IP is an F5 load balancing device. A vulnerability in the F5 BIG-IP's handling of SIP messages containing multipart MIME loads can be exploited by a remote attacker to submit a special request, which can result in a memory error and cause a denial of service attack...

CVE-2020-5926

In BIG-IP versions 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, and 14.1.0-14.1.2.6, a BIG-IP virtual server with a Session Initiation Protocol SIP ALG profile, parsing SIP messages that contain a multi-part MIME payload with certain boundary strings can cause TMM to free memory to the wrong cache...

Grandstream HT800 series OS Command Injection Vulnerability

The Grandstream HT800 series is an HT800 series analog phone adapter from Grandstream. An operating system command injection vulnerability exists in the Grandstream HT800 series using firmware version 1.0.17.5 and earlier. This vulnerability can be exploited to execute arbitrary commands as root ...

CVE-2020-14485

OpenClinic GA versions 5.09.02 and 5.89.05b may allow an attacker to bypass client-side access controls or use a crafted request to initiate a session with limited functionality, which may allow execution of admin functions such as SQL queries...

The vulnerability of the SIP protocol implementation in Cisco IOS and Cisco IOS XE operating systems allows a attacker to trigger a service failure.

The vulnerability of the SIP protocol implementation in Cisco IOS and Cisco IOS XE operating systems is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

Cisco IOS and IOS XE Input Validation Error Vulnerability (CNVD-2020-32903)

Cisco IOS and IOS XE are a set of operating systems developed by Cisco for its network devices. The Session Initiation Protocol SIP inventory in Cisco IOS and Cisco IOS XE is vulnerable to an input validation error, which arises from a program that does not adequately check the integrity of...

CVE-2020-3226 Cisco IOS and IOS XE Software Session Initiation Protocol Denial of Service Vulnerability

A vulnerability in the Session Initiation Protocol SIP library of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service DoS condition. The vulnerability is due to insufficient sanity...

The vulnerability of the VoIP device Mitel MiVoice 5330e arises from an operation that goes beyond the buffer in memory, allowing an attacker to trigger a service failure and execute arbitrary code.

The vulnerability of the VoIP device Mitel MiVoice 5330e arises from an operation that goes beyond the buffer in memory during the processing of SIP/SDP packets. Exploiting this vulnerability allows a malicious actor to cause service failures and execute arbitrary codes...

ALPINE-CVE-2019-18790

An issue was discovered in channels/chansip.c in Sangoma Asterisk 13.x before 13.29.2, 16.x before 16.6.2, and 17.x before 17.0.1, and Certified Asterisk 13.21 before cert5. A SIP request can be sent to Asterisk that can change a SIP peer's IP address. A REGISTER does not need to occur, and calls...

DEBIAN-CVE-2019-18790

An issue was discovered in channels/chansip.c in Sangoma Asterisk 13.x before 13.29.2, 16.x before 16.6.2, and 17.x before 17.0.1, and Certified Asterisk 13.21 before cert5. A SIP request can be sent to Asterisk that can change a SIP peer's IP address. A REGISTER does not need to occur, and calls...

UBUNTU-CVE-2019-18790

An issue was discovered in channels/chansip.c in Sangoma Asterisk 13.x before 13.29.2, 16.x before 16.6.2, and 17.x before 17.0.1, and Certified Asterisk 13.21 before cert5. A SIP request can be sent to Asterisk that can change a SIP peer's IP address. A REGISTER does not need to occur, and calls...

UBUNTU-CVE-2019-18976

An issue was discovered in respjsipt38.c in Sangoma Asterisk through 13.x and Certified Asterisk through 13.21-x. If it receives a re-invite initiating T.38 faxing and has a port of 0 and no c line in the SDP, a NULL pointer dereference and crash will occur. This is different from CVE-2019-18940...

Cisco Adaptive Security Appliance Software and Cisco Firepower Threat Defense Digital Error Vulnerability

Cisco Firepower Threat Defense FTD and Cisco Adaptive Security Appliances Software ASA Software are both products of Cisco, Inc.Cisco Firepower Threat Defense is a set of unified software that provides next-generation firewall services. Defense is a set of unified software to provide...

Cisco Adaptive Security Appliance Software SIP Inspection DoS (cisco-sa-20191002-asa-ftd-sip-dos)

A denial of service DoS vulnerability exists in the Session Initiation Protocol SIP inspection module of Cisco Adaptive Security Appliance ASA due to improper parsing of SIP messages. An unauthenticated, remote attacker can exploit this issue by sending a malicious SIP packet to an affected devic...

The vulnerability of the SIP packet processing service provided by Junos OS on SRX Series routers allows a attacker to induce a service failure.

The vulnerability of the SIP processing service on Junos OS routers of the SRX Series exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

The vulnerability of the SIP ALG application-level gateway on Junos OS MX Series routers allows a attacker to cause a service failure.

The vulnerability of the SIP ALG application-level gateway on Junos OS MX Series routers stems from resource release errors. Exploiting this vulnerability allows a malicious actor to cause service failures by sending specially crafted SIP packets...

Cisco IOS XE Software NAT Session Initiation Protocol Application Layer Gateway DoS (cisco-sa-20190925-sip-alg)

According to its self-reported version, Cisco IOS XE Software is affected by a denial of service DoS vulnerability in the Network Address Translation NAT Session Initiation Protocl SIP Application Layer Gateway ALG. This allows an unauthenticated, remote attacker to cause an affected device to...

CVE-2019-0065

On MX Series, when the SIP ALG is enabled, receipt of a certain malformed SIP packet may crash the MS-PIC component on MS-MIC or MS-MPC. By continuously sending a crafted SIP packet, an attacker can repeatedly bring down MS-PIC on MS-MIC/MS-MPC causing a sustained Denial of Service. This issue...

CVE-2019-0055

A vulnerability in the SIP ALG packet processing service of Juniper Networks Junos OS allows an attacker to cause a Denial of Service DoS to the device by sending specific types of valid SIP traffic to the device. In this case, the flowd process crashes and generates a core dump while processing...

The vulnerability lies in the implementation of the SIP protocol and the NAT function of the Application Layer Gateway (ALG) of the Cisco IOS XE operating system. This allows a attacker to trigger a reboot of the vulnerable device.

The vulnerability of the SIP protocol implementation and the NAT function of the Application Layer Gateway ALG on the Cisco IOS XE operating system is related to errors in processing SIP packets. Exploiting this vulnerability allows a malicious actor to trigger a restart of the vulnerable device ...