CVE-2007-5468

2007-10-1600:00:00

mitre

www.cve.org

AI Score

Confidence

Low

EPSS

0.01

Percentile

83.9%

JSON

Cisco CallManager 5.1.1.3000-5 does not verify the Digest authentication header URI against the Request URI in SIP messages, which allows remote attackers to use sniffed Digest authentication credentials to call arbitrary telephone numbers or spoof caller ID (aka “toll fraud and authentication forward attack”).

References

lists.grok.org.uk/pipermail/full-disclosure/2007-October/066581.html

lists.grok.org.uk/pipermail/full-disclosure/2007-October/066691.html

lists.grok.org.uk/pipermail/full-disclosure/2007-October/066694.html

secunia.com/advisories/27231

www.securityfocus.com/bid/26057

www.vupen.com/english/advisories/2007/3534

exchange.xforce.ibmcloud.com/vulnerabilities/37197