SIP Packets Reload IOS Devices with support for SIP

Cisco devices running an affected version of Internetwork Operating System IOS which supports Session Initiation Protocol SIP are affected by a vulnerability that may lead to a reload of the device when receiving a specific series of packets destined to port 5060. This issue is compounded by a...

ProCheckUp Security Advisory 2006.14

PR06-14: IP Phones based on Centrality Communications/Aredfox PA168 chipset weak session management vulnerability This advisory has been published following consultation with UK NISCC http://www.niscc.gov.uk/ Date Found: 3rd November 2006 Date Public: 22nd January 2007 Vulnerable: Phones confirme...

Code injection

AVM Fritz!Box 7050, and possibly other product models, allows remote attackers to cause a denial of service VoIP application crash via a zero-length UDP packet to the SIP port port 5060...

CVE-2007-0431

AVM Fritz!Box 7050, and possibly other product models, allows remote attackers to cause a denial of service VoIP application crash via a zero-length UDP packet to the SIP port port 5060...

CVE-2007-0431

CVE-2007-0431 affects AVM FRITZ!Box devices (e.g., Fritz!Box 7050) with a VoIP/SIP service. The vulnerability is triggered by sending a zero-length UDP packet to the SIP port (5060), which can cause a denial-of-service (VoIP application crash). Connected sources (NVD/OpenVAS) confirm the affected...

Vote! Pro 4.0 - Multiple PHP Code Execution Vulnerabilities

Vote! Pro 4.0 - Multiple PHP Code Execution Vulnerabilities source: https://www.securityfocus.com/bid/22191/info Multiple VoIP phones using the Aredfox PA168 Chipset are prone to a session-hijacking vulnerability due to a design error. An attacker can exploit this issue to gain administrative...

DoS against AVM Fritz!Box 7050 (and others)

Denial of Service against AVM Fritz!Box 7050 and others Discovered by: Matthias Wenzel Advisory: http://mazzoo.de/blog/2007/01/18FritzBoxDoS Manufacturer: AVM www.avm.de Product: Fritz!Box 750 and others Vendor was notified 6 month ago see blog entry by Matthias Sending a zero-length UDP packet t...

AVM Fritz!Box VoIP router DoS

Crash on empty UDP packet to UDP/5060 SIP port...

Authentication flaw

Unspecified vulnerability in the SIP module in InGate Firewall and SIParator before 4.5.1 allows remote attackers to conduct replay attacks on the authentication mechanism via unknown vectors...

CVE-2007-0334

Unspecified vulnerability in the SIP module in InGate Firewall and SIParator before 4.5.1 allows remote attackers to conduct replay attacks on the authentication mechanism via unknown vectors...

CVE-2007-0334

CVE-2007-0334 affects InGate Firewall and SIParator SIP module prior to version 4.5.1. The issue is a replay vulnerability in the authentication mechanism, allowing remote attackers to replay credentials or authentication data. No concrete exploit details are provided in the supplied documents. R...

CVE-2007-0334

Unspecified vulnerability in the SIP module in InGate Firewall and SIParator before 4.5.1 allows remote attackers to conduct replay attacks on the authentication mechanism via unknown vectors...

OpenSER OSP模块Validateospheader函数缓冲区溢出漏洞

OpenSER是一款开放源码的SIP服务器。 OpenSER的开放结算协议（OSP）模块中Validateospheader函数在处理特制报文时存在缓冲区溢出，远程攻击者可能利用此漏洞在服务器上执行任意指令。 漏洞相关的代码如下： int validateospheader struct sipmsg msg, char ignore1, char ignore2 如果攻击者向服务器发送了恶意报文的话就可能触发这个漏洞，导致远程执行任意指令。 OpenSER OpenSER = 1.1.0 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...

OpenSER SMS处理模块远程溢出漏洞

OpenSER是一款开放源码的SIP服务器。 OpenSER的SMS处理模块存在缓冲区溢出漏洞，远程攻击者可能利用此漏洞在服务器上执行任意指令。 以下函数： int fetchsmsstruct modem mdm, int sim, char pdu 可能会导致内存破坏的情况。如果beginning被拷贝到函数参数PDU char的话就会触发这个漏洞，导致执行任意代码。 OpenSER OpenSER = 1.1.0 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...

OpenSER Parse_Expression远程缓冲区溢出漏洞

OpenSER是一款开放源代码的SIP路由实现。 OpenSER包含的parseexpression函数存在边界条件错误，远程攻击者可以利用漏洞以服务进程权限执行任意指令。 问题存在于static int parseexpressionchar str, expression e, expression eexceptions函数中，由于/str/没有进行正确检查，可能导致覆盖目标缓冲区而造成任意代码执行。目前没有详细漏洞细节提供。 OpenSER OpenSER 1.1 目前没有详细解决方案提供： http://www.openser.org/...

Cisco PIX SIP实现未授权UDP端口转发漏洞

Cisco PIX是一款流行的硬件防火墙设备。 Cisco PIX 500系列安全设备处理SIP消息时存在问题，远程攻击者可以利用漏洞转发UDP包到任意设备，造成绕过防火墙设置获得敏感信息。 当接收到特殊的SIP消息时，PIX会打开UDP连接到内部网络的任意设备，此连接允许攻击者发送任意UDP通信到内部设备，导致绕过防火墙规则进行通信。 Cisco PIX Firewall 535 Cisco PIX Firewall 525 6.3 Cisco PIX Firewall 525 Cisco PIX Firewall 520 Cisco PIX Firewall 515E Cisco P...

[Full-disclosure] Asterisk Local and Remote Denial of Service Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Product: Asterisk Open Source PBX Impact: Multiple Local and Remote Denials of Service Versions: All versions prior to 1.2.13 Author: Jesus Oquendo echo @infiltrated|sed 's/^/sil/g;s/$/.net/g' I. BACKGROUND Asterisk is an Open Source PBX which runs on...

SIP Invite Spoof

This module will create a fake SIP invite request making the targeted device ring and display fake caller id information. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SIP Invite Spoof',...

Asterisk chan_skinny远程缓冲区溢出漏洞

Asterisk是一款PBX系统的软件，运行在Linux系统上，支持使用SIP、IAX、H323协议进行IP通话。 Asterisk的chanskinny.c文件中的static int getinputstruct skinnysession s函数没有正确地验证报文头中用户所提供的长度。远程攻击者可以通过发送特制报文来触发缓冲区溢出漏洞，导致执行任意指令。 asterisk-1.2.12.1/channels/chanskinny.c的2860-2870中的漏洞代码： ---------------- res = reads-fd, s-inbuf, 4; // - integer...

CVE-2006-5445

Unspecified vulnerability in the SIP channel driver channels/chansip.c in Asterisk 1.2.x before 1.2.13 and 1.4.x before 1.4.0-beta3 allows remote attackers to cause a denial of service resource consumption via unspecified vectors that result in the creation of "a real pvt structure" that uses mor...