Date: Wed, 14 Jan 2009 13:29:32 +0100
From: Laurent Butti <laurent.butti@orange-ftgroup.com.>
To: [email protected]Subject: Cisco Unified IP Phone 7960G and 7940G (SIP) RTP Header Vulnerability
X-Enigmail-Version: 0.95.7
Content-Type: text/plain; charset=ISO-8859-15
Content-Transfer-Encoding: 7bit
X-OriginalArrivalTime: 14 Jan 2009 12:29:21.0597 (UTC) FILETIME=[BA393ED0:01C97643]
X-Virus-Scanned: antivirus-gw at tyumen.ru
Title:
* Cisco Unified IP Phone 7960G and 7940G (SIP) RTP Header Vulnerability
Summary:
* The Cisco Unified IP Phone 7960G and 7940G (SIP) do not correctly
parse some malformed RTP headers leading to a deterministic denial of
service
Assigned CVE:
* CVE-2008-4444
Details:
* SIP protocol is used to set up calls between phones. Once the call is
established, the media content is carried by the RTP protocol. A remote
attacker could send a specially crafted RTP packet against a Cisco SIP
phone in such a way as to cause the phone to reboot.
Attack Impact:
* Denial-of-service (reboot or hang-up) and possibly remote arbitrary
code execution
Attack Vector:
* Have the possibility to setup a call to the targeted phone and carry
RTP frame to the vulnerable device
* Have access to the VoIP network while a call is established and inject
RTP frames
Timeline:
* 2008-06-13 - Vulnerability reported to Cisco
* 2008-06-16 - Full details sent to Cisco
* 2008-10-21 - Cisco released a patched firmware
* 2009-01-14 - Release of this security advisory
Affected Products:
* Cisco Unified IP Phone 7960G and 7940G (SIP) with P0S3-08-9-00
firmware. Cisco released a patched firmware on October 21, 2008 which is
described in the bug identifier CSCsu22285 (Cisco Unified IP Phone 7960G
and 7940G (SIP) Release Notes for Firmware Release 8.10).
Credits:
* This vulnerability was discovered by Gabriel Campana and Laurent Butti
from France Telecom / Orange
