Polycom SoundPoint IP SIP Phones INVITE Message Remote Denial of Service Vulnerability
BID:24542
Info
Polycom SoundPoint IP SIP Phones INVITE Message Remote Denial of Service Vulnerability
| Bugtraq ID: | 24542 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2007-3369 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 19 2007 12:00AM |
| Updated: | Jun 27 2007 12:48AM |
| Credit: | Sipera VIPER Lab is credited with the discovery of this vulnerability. |
| Vulnerable: |
Polycom SoundPoint IP 601 0 Polycom SoundPoint IP 650 Polycom SoundPoint IP 601 Polycom SoundPoint IP 600 Polycom SoundPoint IP 550 Polycom SoundPoint IP 501 Polycom SoundPoint IP 500 Polycom SoundPoint IP 430 Polycom SoundPoint IP 4000 Polycom SoundPoint IP 301 Polycom SoundPoint IP 300 |
| Not Vulnerable: | |
Discussion
Polycom SoundPoint IP SIP Phones INVITE Message Remote Denial of Service Vulnerability
Polycom SoundPoint IP phones are prone to a denial-of-service vulnerability because the devices fail to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.
Successfully exploiting this issue allows remote attackers to crash affected devices, requiring a reboot by physically disconnecting and reconnecting the device's power supply to recover. Given the nature of the issue, code execution may also be possible, but this has not been confirmed.
NOTE: According to new information, this vulnerability may be triggered through a long string in the 'VIA:' field.
Phones SoundPoint IP 300, 301, 430, 500, 501, 550, 600, 601, 650 and IP 4000 phones running all SIP software revisions are vulnerable to this issue.
Polycom SoundPoint IP phones are prone to a denial-of-service vulnerability because the devices fail to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.
Successfully exploiting this issue allows remote attackers to crash affected devices, requiring a reboot by physically disconnecting and reconnecting the device's power supply to recover. Given the nature of the issue, code execution may also be possible, but this has not been confirmed.
NOTE: According to new information, this vulnerability may be triggered through a long string in the 'VIA:' field.
Phones SoundPoint IP 300, 301, 430, 500, 501, 550, 600, 601, 650 and IP 4000 phones running all SIP software revisions are vulnerable to this issue.
Exploit / POC
Polycom SoundPoint IP SIP Phones INVITE Message Remote Denial of Service Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].
Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].
Solution / Fix
Polycom SoundPoint IP SIP Phones INVITE Message Remote Denial of Service Vulnerability
Solution:
The reporter of this issue states that the vendor is working on a fix to address this issue. Users of affected devices should contact the vendor. Technical Bulletin TB36233 is reportedly available for more information. Symantec has not confirmed this.
Solution:
The reporter of this issue states that the vendor is working on a fix to address this issue. Users of affected devices should contact the vendor. Technical Bulletin TB36233 is reportedly available for more information. Symantec has not confirmed this.
References
Polycom SoundPoint IP SIP Phones INVITE Message Remote Denial of Service Vulnerability
References:
References:
- SoundPoint IP Homepage (Polycom)
- SoundPoint IP® Family Technical Bulletin �?? TB 36233 (Polycom)
- Buffer overflow vulnerability in Polycom SoundPoint IP 601 SIP phone may allow r (Sipera Systems)