VocalTec VGW120/ VGW480 Telephony Gateway Remote H.225 Denial Of Service Vulnerability

Bugtraq ID:	10411
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	May 24 2004 12:00AM
Updated:	May 24 2004 12:00AM
Credit:	Discovery of this vulnerability has been credited to Alexander <[email protected]>.
Vulnerable:	VocalTec VGW480 Telephony Gateway VocalTec VGW120 Telephony Gateway
Not Vulnerable:

VocalTec VGW120/ VGW480 Telephony Gateway Remote H.225 Denial Of Service Vulnerability

It has been reported that the VocalTec VGW120 and VGW480 Telephony Gateways are prone to a remote denial of service vulnerability. The issue is reported to exist in the ASN.1/H.323/H.225 stack.

A remote attacker may exploit this issue to deny service to the affected appliances.

VocalTec VGW120/ VGW480 Telephony Gateway Remote H.225 Denial Of Service Vulnerability

The following proof of concept exploit is available:

• /data/vulnerabilities/exploits/killvoc-small.c

VocalTec VGW120/ VGW480 Telephony Gateway Remote H.225 Denial Of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

VocalTec VGW120/ VGW480 Telephony Gateway Remote H.225 Denial Of Service Vulnerability

References:

• VocalTec Homepage (VocalTec)
  
• Vulnerability in Vocaltec VoIP-Gateways in stack ASN.1/H.323/H.225 (Securitylab.ru)