Firm Sees More DDoS Attacks Aimed at Telecom Systems

Attackers are now using DDoS services that offer attacks on telecommunication systems as part of larger attack schemes. These attacks, known as TDoS attacks, can be a relatively cheap option for cybercriminals looking into diversifying their attack vectors. Researchers have seen a series of...

Fedora 17 : asterisk-10.5.2-1.fc17 (2012-10324)

The Asterisk Development Team has announced security releases for Certified Asterisk 1.8.11 and Asterisk 1.8 and 10. The available security releases are released as versions 1.8.11-cert4, 1.8.13.1, 10.5.2, and 10.5.2-digiumphones. These releases are available for immediate download at...

Asterisk Endpoint Provisional Response Parsing RTP Port Consumption Remote DoS (AST-2012-010)

According to the version in its SIP banner, the version of Asterisk running on the remote host is potentially affected by a vulnerability that could allow a remote, authenticated attacker to exhaust the server of resources. If an endpoint sends a provisional response to the server's re-INVITE...

Phonalisa 5.0 VoiP Code Execution / Cross Site Scripting

Title: ====== Phonalisa v5.0 VoiP - Multiple Web Vulnerabilities Date: ===== 2012-06-16 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=526 VL-ID: ===== 526 Common Vulnerability Scoring System: ==================================== 6.5 Introduction: ============= Die...

CVE-2012-3863

channels/chansip.c in Asterisk Open Source 1.8.x before 1.8.13.1 and 10.x before 10.5.2, Asterisk Business Edition C.3.x before C.3.7.5, Certified Asterisk 1.8.11-certx before 1.8.11-cert4, and Asterisk Digiumphones 10.x.x-digiumphones before 10.5.2-digiumphones does not properly handle a...

DEBIAN-CVE-2012-3863

channels/chansip.c in Asterisk Open Source 1.8.x before 1.8.13.1 and 10.x before 10.5.2, Asterisk Business Edition C.3.x before C.3.7.5, Certified Asterisk 1.8.11-certx before 1.8.11-cert4, and Asterisk Digiumphones 10.x.x-digiumphones before 10.5.2-digiumphones does not properly handle a...

CVE-2012-3863

channels/chansip.c in Asterisk Open Source 1.8.x before 1.8.13.1 and 10.x before 10.5.2, Asterisk Business Edition C.3.x before C.3.7.5, Certified Asterisk 1.8.11-certx before 1.8.11-cert4, and Asterisk Digiumphones 10.x.x-digiumphones before 10.5.2-digiumphones does not properly handle a...

CVE-2012-3863

channels/chansip.c in Asterisk Open Source 1.8.x before 1.8.13.1 and 10.x before 10.5.2, Asterisk Business Edition C.3.x before C.3.7.5, Certified Asterisk 1.8.11-certx before 1.8.11-cert4, and Asterisk Digiumphones 10.x.x-digiumphones before 10.5.2-digiumphones does not properly handle a...

Cross site request forgery (csrf)

channels/chansip.c in Asterisk Open Source 1.8.x before 1.8.13.1 and 10.x before 10.5.2, Asterisk Business Edition C.3.x before C.3.7.5, Certified Asterisk 1.8.11-certx before 1.8.11-cert4, and Asterisk Digiumphones 10.x.x-digiumphones before 10.5.2-digiumphones does not properly handle a...

CVE-2012-3863

CVE-2012-3863 affects Asterisk Open Source 1.8.x before 1.8.13.1 and 10.x before 10.5.2 (also in various packaged releases such as Certified Asterisk and Digiumphones) due to improper handling of a provisional SIP reINVITE response in channels/chan_sip.c. This can allow remote authenticated users...

CVE-2012-3863

channels/chansip.c in Asterisk Open Source 1.8.x before 1.8.13.1 and 10.x before 10.5.2, Asterisk Business Edition C.3.x before C.3.7.5, Certified Asterisk 1.8.11-certx before 1.8.11-cert4, and Asterisk Digiumphones 10.x.x-digiumphones before 10.5.2-digiumphones does not properly handle a...

CVE-2012-3863

channels/chansip.c in Asterisk Open Source 1.8.x before 1.8.13.1 and 10.x before 10.5.2, Asterisk Business Edition C.3.x before C.3.7.5, Certified Asterisk 1.8.11-certx before 1.8.11-cert4, and Asterisk Digiumphones 10.x.x-digiumphones before 10.5.2-digiumphones does not properly handle a...

sip-methods NSE Script

Enumerates a SIP Server's allowed methods INVITE, OPTIONS, SUBSCRIBE, etc. The script works by sending an OPTION request to the server and checking for the value of the Allow header in the response. Script Arguments sip.timeout See the documentation for the sip library. Example Usage nmap...

sip-call-spoof NSE Script

Spoofs a call to a SIP phone and detects the action taken by the target busy, declined, hung up, etc. This works by sending a fake sip invite request to the target phone and checking the responses. A response with status code 180 means that the phone is ringing. The script waits for the next...

Debian DSA-2493-1 : asterisk - denial of service

Several vulnerabilities were discovered in Asterisk, a PBX and telephony toolkit. - CVE-2012-2947 The IAX2 channel driver allows remote attackers to cause a denial of service daemon crash by placing a call on hold when a certain mohinterpret setting is enabled. - CVE-2012-2948 The Skinny channel...

Qutecom SoftPhone 2.2.1 - Heap Overflow Crash (Denial of Service) (PoC)

Title: Qutecom Cross-platform, open source softphone Heap Overflow DoS/Crash Proof of Concept Date: 14th June 2012 Exploit Author: Debasish Mandal Author's Blog : http://www.debasish.in/ Vendor Homepage: http://qutecom.org/ Software Link:...

Qutecom SoftPhone 2.2.1 - Heap Overflow Crash (Denial of Service) PoC)

Qutecom SoftPhone 2.2.1 - Heap Overflow Crash Denial of Service PoC Title: Qutecom Cross-platform, open source softphone Heap Overflow DoS/Crash Proof of Concept Date: 14th June 2012 Exploit Author: Debasish Mandal Author's Blog : http://www.debasish.in/ Vendor Homepage: http://qutecom.org/...

Qutecom Softphone 2.2.1 Heap Overflow DoS/Crash Proof of Concept

Exploit for windows platform in category dos / poc Title: Qutecom Cross-platform, open source softphone Heap Overflow DoS/Crash Proof of Concept Date: 14th June 2012 Exploit Author: Debasish Mandal Author's Blog : http://www.debasish.in/ Vendor Homepage: http://qutecom.org/ Software Link:...

Asterisk SIP Channel Driver DoS Vulnerability

Asterisk is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2012 NopSec Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later CPE = "cpe:/a:digium:asterisk";...

Phonalisa v5.0 VoiP - Multiple Web Vulnerabilities

Document Title: =============== Phonalisa v5.0 VoiP - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=526 Release Date: ============= 2012-06-16 Vulnerability Laboratory ID VL-ID: ==================================== 526 Comm...