Memory corruption

Memory leak in the Session Initiation Protocol SIP implementation in Cisco IOS 12.2 through 12.4, when VoIP is configured, allows remote attackers to cause a denial of service memory consumption and voice-service outage via unspecified valid SIP messages...

Design/Logic Flaw

Unspecified vulnerability in the Session Initiation Protocol SIP implementation in Cisco IOS 12.2 through 12.4, when VoIP is configured, allows remote attackers to cause a denial of service device reload via unspecified valid SIP messages, aka Cisco bug ID CSCsk42759, a different vulnerability th...

Design/Logic Flaw

Unspecified vulnerability in the Session Initiation Protocol SIP implementation in Cisco IOS 12.2 through 12.4 and Unified Communications Manager 4.1 through 6.1, when VoIP is configured, allows remote attackers to cause a denial of service device or process reload via unspecified valid SIP...

CVE-2008-3801

Unspecified vulnerability in the Session Initiation Protocol SIP implementation in Cisco IOS 12.2 through 12.4 and Unified Communications Manager 4.1 through 6.1, when VoIP is configured, allows remote attackers to cause a denial of service device or process reload via unspecified valid SIP...

CVE-2008-3802

Unspecified vulnerability in the Session Initiation Protocol SIP implementation in Cisco IOS 12.2 through 12.4, when VoIP is configured, allows remote attackers to cause a denial of service device reload via unspecified valid SIP messages, aka Cisco bug ID CSCsk42759, a different vulnerability th...

CVE-2008-3802

CVE-2008-3802 refers to DoS in Cisco IOS SIP handling (12.2–12.4) when VoIP is enabled, triggered by processing certain valid SIP messages, potentially causing a device reload. Related CVEs CVE-2008-3800 and CVE-2008-3801 cover additional SIP DoS issues in IOS/CUCM; the issues are tracked under C...

CVE-2008-3800

Unspecified vulnerability in the Session Initiation Protocol SIP implementation in Cisco IOS 12.2 through 12.4 and Unified Communications Manager 4.1 through 6.1, when VoIP is configured, allows remote attackers to cause a denial of service device or process reload via unspecified valid SIP...

Security Best Practice: Protect Yourself from VoIP Denial of Service Vulnerabilities

VoIP opens voice communications to the same kinds of security threats that imperil data communications. Attacks on data communications can come through the IP voice infrastructure and vice versa. Denial of service attacks targeting weak VoIP elements could flood the network with voice traffic,...

Asterisk IAX2 (IAX) POKE Request Saturation Resource Exhaustion Remote DoS

The version of Asterisk running on the remote host consumes an IAX2 call number while waiting for an ACK packet in response to a PONG packet. By flooding the affected service with POKE requests, an unauthenticated, remote attacker can leverage this issue to exhaust all available call numbers and...

Asterisk IAX2 FWDOWNL Request Spoofing Remote DoS

The firmware download protocol implemented in the version of Asterisk running on the remote host does not initiate a handshake. By spoofing an IAX2 FWDOWNL request, an unauthenticated, remote attacker may be able to leverage this issue to flood a third-party host with unwanted firmware packets fr...

Asterisk IAX 'POKE'请求远程拒绝服务漏洞

BUGTRAQ ID: 30321 CNCAN ID：CNCAN-2008072205 Asterisk是开放源码的软件PBX，支持各种VoIP协议和设备。 Asterisk处理多个IAX 'POKE'请求存在问题，远程攻击者可以利用漏洞对应用程序进行拒绝服务攻击。 攻击者可以发送持续的'POKE'请求流可导致服务程序消耗大量处理器资源，造成应用程序停止响应，触发拒绝服务攻击。 Asterisk Asterisk Business Edition C.1.8.1 Asterisk Asterisk Business Edition C.1.6.2 Asterisk Asterisk...

reSIProcate 1.3.2 - Remote Denial of Service (PoC)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Remote DoS in reSIProcate MU-200807-01 July 10, 2008 http://labs.mudynamics.com/advisories.html Affected Products/Versions: repro SIP proxy/registrar 1.3.2 http://www.resiprocate.org/ReSIProcate1.3.2Release Any product using the reSIProcate SIP stack...

Asterisk SIP Remote Authentication Bypass

The version of Asterisk running on the remote host allows unauthenticated calls via the SIP channel driver. Using a specially crafted From header, a remote attacker can bypass authentication and make calls into the context specified in the 'general' section of 'sip.conf'. %NASLMINLEVEL 70300 C...

Asterisk IAX2 Multiple Method Handshake Spoofing DoS

The version of Asterisk running on the remote host does not properly validate an IAX2 handshake. By spoofing NEW and ACK messages, an unauthenticated, remote attacker may be able to leverage this issue to flood a third-party host with packets from the affected host containing audio data. C Tenabl...

[SECURITY] Fedora 7 Update: asterisk-1.4.19.1-1.fc7

Asterisk is a complete PBX in software. It runs on Linux and provides all of the features you would expect from a PBX and more. Asterisk does voice over IP in three protocols, and can interoperate with almost all standards-based telephony equipment using relatively inexpensive hardware...

[SECURITY] Fedora 7 Update: speex-1.2-0.3.beta1

Speex is a patent-free compression format designed especially for speech. It is specialized for voice communications at low bit-rates in the 2-45 kbps range. Possible applications include Voice over IP VoIP, Internet audio streaming, audio books, and archiving of speech data e.g. voice mail...

[SECURITY] Fedora 8 Update: asterisk-1.4.18.1-1.fc8

Asterisk is a complete PBX in software. It runs on Linux and provides all of the features you would expect from a PBX and more. Asterisk does voice over IP in three protocols, and can interoperate with almost all standards-based telephony equipment using relatively inexpensive hardware...

Asterisk日志函数及管理器远程格式串处理漏洞

BUGTRAQ ID: 28311 CVECAN ID: CVE-2008-1333 Asterisk是开放源码的软件PBX，支持各种VoIP协议和设备。 Asterisk的日志和管理器功能实现上存在漏洞，远程攻击者可能利用此漏洞导致拒绝服务。 使用astverbose日志API调用所显示的日志消息没有显示为字符串，而是格式串；管理器命令command结果输出没有作为字符串附加到生成的响应消息中，而是附加为格式串。这两种情况都允许攻击者在输入中提交特意的格式串值导致崩溃。 Asterisk Asterisk 1.6.x Asterisk --------...

Asterisk绕过呼叫认证漏洞

BUGTRAQ ID: 28310 CVECAN ID: CVE-2008-1332 Asterisk是开放源码的软件PBX，支持各种VoIP协议和设备。 Asterisk在处理呼叫选项时存在漏洞，远程攻击者可能利用此漏洞执行非授权操作。 远程攻击者可以通过SIP通道驱动使用无效的From头执行非授权呼叫，这种操作类似于SIP配置选项allowguest=yes，也就是带有特制From头的呼叫会发送给sip.conf的通用部分所指定环境中的PBX。 Asterisk Asterisk 1.4.x Asterisk Asterisk 1.2.x Asterisk Asterisk 1.0....

CVE-2008-1334

cgi/b on the BT Home Hub router allows remote attackers to bypass authentication, and read or modify administrative settings or make arbitrary VoIP telephone calls, by placing a character at the end of the PATHINFO, as demonstrated by 1 %5C encoded backslash, 2 '%' percent, and 3 '' tilde. NOTE:...