Cisco Unified IP Phone RTP Audio Stream Eavesdropping Vulnerability

Bugtraq ID:	26668
Class:	Design Error
CVE:	CVE-2007-6190
Remote:	Yes
Local:	No
Published:	Dec 01 2007 12:00AM
Updated:	Dec 05 2007 04:42PM
Credit:	Joffrey Czarny of Telindus is credited with the discovery of this vulnerability.
Vulnerable:	Cisco Unified IP Phone 8.2(1) Cisco Unified IP Phone 8.0(4)SR2 Cisco Unified IP Phone 8.0(4)SR1 Cisco Unified IP Phone 7971G Cisco Unified IP Phone 7970G Cisco Unified IP Phone 7961G Cisco Unified IP Phone 7941G Cisco Unified IP Phone 7911G Cisco Unified IP Phone 7906G
Not Vulnerable:

Cisco Unified IP Phone RTP Audio Stream Eavesdropping Vulnerability

Cisco Unified IP Phone is prone to a vulnerability that allows eavesdropping.

An attacker can exploit this issue to transmit or receive audio stream data to an unsuspecting victim.

Successfully exploiting this issue will allow the attacker to access sensitive information.

Cisco Unified IP Phone RTP Audio Stream Eavesdropping Vulnerability

An attacker can exploit this issue by using readily available network utilities.

Cisco Unified IP Phone RTP Audio Stream Eavesdropping Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Cisco Unified IP Phone RTP Audio Stream Eavesdropping Vulnerability

References:

• Cisco Unified IP Phone Homepage (Cisco )
  
• Cisco Unified IP Phone Remote Eavesdropping (Cisco)