GrandStream GXP-2000 VoIP Phone Denial Of Service Vulnerability

Bugtraq ID:	20356
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Oct 05 2006 12:00AM
Updated:	Oct 05 2006 08:15PM
Credit:	Shawn Merdinger is credited with the discovery of this vulnerability.
Vulnerable:	Grandstream VoIP Phone GXP-2000 1.1.0.5
Not Vulnerable:

GrandStream GXP-2000 VoIP Phone Denial Of Service Vulnerability

GrandStream GXP-2000 VoIP phones are prone to denial-of-service vulnerability because the device fails to properly handle excessive amounts of UDP traffic.

Exploiting this issue allows remote attackers to crash or restart affected devices, denying service to legitimate users.

Firmware 1.1.0.5 is vulnerable to this issue; other versions may also be affected.

GrandStream GXP-2000 VoIP Phone Denial Of Service Vulnerability

Attackers can exploit this issue by using readily available network utilities such as NetCat.

GrandStream GXP-2000 VoIP Phone Denial Of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

GrandStream GXP-2000 VoIP Phone Denial Of Service Vulnerability

References:

• GrandStream GXP-2000 VoIP Desktop Phone multiple undocumented UDP ports and D (Shawn Merdinger)
  
• GXP-2000 Enterprise IP Telephone Home Page (Grandstream Networks)