CVE-2007-5537: Undefined Security Weakness

Cisco Unified Communications Manager CUCM, formerly CallManager 5.1 before 5.12, and Unified CallManager 5.0, allow remote attackers to cause a denial of service kernel panic via a flood of SIP INVITE messages to UDP port 5060, which triggers resource exhaustion, aka CSCsi75822...

CVE-2007-5537

CVE-2007-5537 affects Cisco Unified Communications Manager (CUCM, former CallManager) 5.1 before 5.1(2) and Unified CallManager 5.0. The vulnerability allows remote attackers to cause a denial of service (kernel panic) by sending a flood of SIP INVITE messages to UDP port 5060, triggering resourc...

CVE-2007-5537

Cisco Unified Communications Manager CUCM, formerly CallManager 5.1 before 5.12, and Unified CallManager 5.0, allow remote attackers to cause a denial of service kernel panic via a flood of SIP INVITE messages to UDP port 5060, which triggers resource exhaustion, aka CSCsi75822...

Sql injection

Multiple SQL injection vulnerabilities in cdraddonmysql in Asterisk-Addons before 1.2.8, and 1.4.x before 1.4.4, allow remote attackers to execute arbitrary SQL commands via the 1 source and 2 destination numbers, and probably 3 SIP URI, when inserting a record...

CVE-2007-5488

Multiple SQL injection vulnerabilities in cdraddonmysql in Asterisk-Addons before 1.2.8, and 1.4.x before 1.4.4, allow remote attackers to execute arbitrary SQL commands via the 1 source and 2 destination numbers, and probably 3 SIP URI, when inserting a record...

CVE-2007-5488

Multiple SQL injection vulnerabilities in cdraddonmysql in Asterisk-Addons before 1.2.8, and 1.4.x before 1.4.4, allow remote attackers to execute arbitrary SQL commands via the 1 source and 2 destination numbers, and probably 3 SIP URI, when inserting a record...

CVE-2007-5488: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in cdraddonmysql in Asterisk-Addons before 1.2.8, and 1.4.x before 1.4.4, allow remote attackers to execute arbitrary SQL commands via the 1 source and 2 destination numbers, and probably 3 SIP URI, when inserting a record...

openSUSE 10 Security Update : asterisk (asterisk-2272)

This update fixes 2 security problem in the PBX software Asterisk. CVE-2006-5444: Integer overflow in the getinput function in the Skinny channel driver chanskinny.c as used by Cisco SCCP phones, allows remote attackers to execute arbitrary code via a certain dlen value that passes a signed integ...

Cisco CallManager和Openser SIP消息非授权呼叫漏洞

BUGTRAQ ID: 26057 Cisco CallManager和OpenSER都是常用的网络IP电话解决方案。 Cisco CallManager和OpenSER没有检查用户在Digest认证头中所提供的URI是否与消息的REQUEST-URI一致，这允许恶意用户从正常用户嗅探Digest认证，然后代表该用户呼叫任意扩展。 Cisco Call Manger 5.1.1.3000-5 OpenSER OpenSER 1.2.2 Cisco ----- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...

CVE-2007-5469

OpenSER 1.2.2 does not verify the Digest authentication header URI against the Request URI in SIP messages, which allows remote attackers to use sniffed Digest authentication credentials to call arbitrary telephone numbers or spoof caller ID aka "toll fraud and authentication forward attack". NOT...

Authentication flaw

OpenSER 1.2.2 does not verify the Digest authentication header URI against the Request URI in SIP messages, which allows remote attackers to use sniffed Digest authentication credentials to call arbitrary telephone numbers or spoof caller ID aka "toll fraud and authentication forward attack". NOT...

CVE-2007-5468

Cisco CallManager 5.1.1.3000-5 does not verify the Digest authentication header URI against the Request URI in SIP messages, which allows remote attackers to use sniffed Digest authentication credentials to call arbitrary telephone numbers or spoof caller ID aka "toll fraud and authentication...

CVE-2007-5469

OpenSER 1.2.2 does not verify the Digest authentication header URI against the Request URI in SIP messages, which allows remote attackers to use sniffed Digest authentication credentials to call arbitrary telephone numbers or spoof caller ID aka "toll fraud and authentication forward attack". NOT...

CVE-2007-5469

CVE-2007-5469 concerns OpenSER 1.2.2, where the system does not verify the Digest authentication header URI against the Request URI in SIP messages. This mismatch allows remote attackers to use sniffed Digest credentials to initiate calls to arbitrary telephone numbers or spoof caller ID (describ...

CVE-2007-5469: Undefined Security Weakness

OpenSER 1.2.2 does not verify the Digest authentication header URI against the Request URI in SIP messages, which allows remote attackers to use sniffed Digest authentication credentials to call arbitrary telephone numbers or spoof caller ID aka "toll fraud and authentication forward attack". NOT...

CVE-2007-5468

Cisco CallManager 5.1.1.3000-5 is vulnerable because it does not verify the Digest authentication header URI against the SIP Request URI. This allows remote attackers to use sniffed Digest credentials to place arbitrary calls or spoof caller ID (toll fraud and authentication forward attack). The ...

CVE-2007-5468: Undefined Security Weakness

Cisco CallManager 5.1.1.3000-5 does not verify the Digest authentication header URI against the Request URI in SIP messages, which allows remote attackers to use sniffed Digest authentication credentials to call arbitrary telephone numbers or spoof caller ID aka "toll fraud and authentication...

S21SEC-037-en: OPAL SIP Protocol Remote Denial of Service

S21Sec Advisory - Title: OPAL SIP Protocol Remote Denial of Service ID: S21SEC-037-en Severity: Medium - Remote DoS History: 11.Jun.2007 Vulnerability discovered 09.Jul.2007 Vendor contacted 15.Aug.2007 Patched 17.Sep.2007 New version released Scope: Remote Denial of Service Platforms: Any...

Cross site scripting

Cross-site scripting XSS vulnerability in the Linksys SPA941 VoIP Phone with firmware 5.1.8 allows remote attackers to inject arbitrary web script or HTML via the From header in a SIP message...

CVE-2007-5411

Cross-site scripting XSS vulnerability in the Linksys SPA941 VoIP Phone with firmware 5.1.8 allows remote attackers to inject arbitrary web script or HTML via the From header in a SIP message...