PolyCom IP-301 VoIP Desktop Phone HTTP Server Denial Of Service Vulnerabilities

Bugtraq ID:	20351
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Oct 05 2006 12:00AM
Updated:	Oct 05 2006 07:35PM
Credit:	Shawn Merdinger has been credited with the discovery of these vulnerabilities.
Vulnerable:	Polycom VoIP Phone IP-301
Not Vulnerable:

PolyCom IP-301 VoIP Desktop Phone HTTP Server Denial Of Service Vulnerabilities

PolyCom IP-301 VoIP phones are prone to denial-of-service vulnerabilities because the device fails to properly handle large user-supplied input values in HTTP traffic.

Exploiting these issues allows remote attackers to reset affected devices, denying service to legitimate users.

PolyCom IP-301 VoIP Desktop Phone HTTP Server Denial Of Service Vulnerabilities

Attackers can exploit these issues via a browser.

PolyCom IP-301 VoIP Desktop Phone HTTP Server Denial Of Service Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

PolyCom IP-301 VoIP Desktop Phone HTTP Server Denial Of Service Vulnerabilities

References:

• PolyCom VoIP 1P-301 Home Page (PolyCom)