AGEPhone SIP Soft Phone Malformed Delimiter Denial of Service Vulnerability

Bugtraq ID:	24543
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2007-3362
Remote:	Yes
Local:	No
Published:	Jun 19 2007 12:00AM
Updated:	Jun 28 2007 02:48AM
Credit:	Sipera VIPER lab team is credited with discovering this issue.
Vulnerable:	Ageet AGEphone for Windows Mobile 5 1.41.2
Not Vulnerable:

AGEPhone SIP Soft Phone Malformed Delimiter Denial of Service Vulnerability

AGEphone SIP softphone is prone to a remote denial-of-service vulnerability, because the application fails to properly handle malformed data.

Successful exploits can allow remote attackers to crash the affected application, denying further service to legitimate users.

This issue affects AGEphone 1.41.2 running on HTC HyTN wireless smartphone using Windows Mobile 5 PPC. Other versions may also be affected.

AGEPhone SIP Soft Phone Malformed Delimiter Denial of Service Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

AGEPhone SIP Soft Phone Malformed Delimiter Denial of Service Vulnerability

Solution:
Reportedly, the vendor released AGEphone 1.62 to address this issue, but Symantec has not confirmed this. Please contact the vendor for information on obtaining and applying fixes.

AGEPhone SIP Soft Phone Malformed Delimiter Denial of Service Vulnerability

References:

• AGEphone (Ageet)
  
• VIPER-2007-027: HTC HyTN using Windows Mobile 5 PPC and AGEPhone SIP soft phone (Sipera)