Cisco Unified IP Phone 7960G and 7940G (SIP) RTP Header Vulnerability
Summary:
The Cisco Unified IP Phone 7960G and 7940G (SIP) do not correctly
parse some malformed RTP headers leading to a deterministic denial of
service
Assigned CVE:
CVE-2008-4444
Details:
SIP protocol is used to set up calls between phones. Once the call is
established, the media content is carried by the RTP protocol. A remote
attacker could send a specially crafted RTP packet against a Cisco SIP
phone in such a way as to cause the phone to reboot.
Attack Impact:
Denial-of-service (reboot or hang-up) and possibly remote arbitrary
code execution
Attack Vector:
Have the possibility to setup a call to the targeted phone and carry
RTP frame to the vulnerable device
Have access to the VoIP network while a call is established and inject
RTP frames
Timeline:
2008-06-13 - Vulnerability reported to Cisco
2008-06-16 - Full details sent to Cisco
2008-10-21 - Cisco released a patched firmware
2009-01-14 - Release of this security advisory
Affected Products:
Cisco Unified IP Phone 7960G and 7940G (SIP) with P0S3-08-9-00
firmware. Cisco released a patched firmware on October 21, 2008 which is
described in the bug identifier CSCsu22285 (Cisco Unified IP Phone 7960G
and 7940G (SIP) Release Notes for Firmware Release 8.10).
Credits:
This vulnerability was discovered by Gabriel Campana and Laurent Butti
from France Telecom / Orange