Aastra 9112i SIP Phone SIP Message Denial Of Service Vulnerability

Bugtraq ID:	24537
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2007-3349
Remote:	Yes
Local:	No
Published:	Jun 19 2007 12:00AM
Updated:	Jun 26 2007 11:38PM
Credit:	Sipera VIPER Lab is credited with the discovery of this vulnerability.
Vulnerable:	Aastra 9112i SIP Phone 1.4.0.1048 Aastra 9112i SIP Phone 0
Not Vulnerable:

Aastra 9112i SIP Phone SIP Message Denial Of Service Vulnerability

Aastra 9112i IP phone is prone to a denial-of-service vulnerability because the device fails to handle specially crafted SIP messages.

An attacker can exploit this issue to crash the affected device, denying service to legitimate users.

This issue affects firmware 1.4.0.1048, boot version: 1.1.0.10.

Aastra 9112i SIP Phone SIP Message Denial Of Service Vulnerability

Currently we are not aware of any exploits for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

Aastra 9112i SIP Phone SIP Message Denial Of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

Aastra 9112i SIP Phone SIP Message Denial Of Service Vulnerability

References:

• Aastra 9112i SIP Phone Home Page (Aastra)
  
• Improper error handling vulnerability in Aastra 9112i SIP phone may allow an att (Sipera VIPER Lab)